Overview

URLaze.bkin-8443.space/
IP 172.67.188.40 (United States)
ASN#13335 CLOUDFLARENET
UserAgentMozilla/5.0 (X11; Linux x86_64; rv:96.0) Gecko/20100101 Firefox/96.0
Referer
Report completed2022-11-26 15:49:00 UTC
StatusLoading report..
IDS alerts0
Blocklist alert5
urlquery alerts No alerts detected
Tags None

Domain Summary (68)

Fully Qualifying Domain Name Rank First Seen Last Seen IP Comment
cdn.seon.io (1) 212690 2020-04-21 11:37:11 UTC 2022-11-26 07:32:18 UTC 54.230.111.74
dsp-ap.eskimi.com (1) 62069 2019-10-03 09:45:00 UTC 2022-11-26 05:58:55 UTC 35.186.201.99
casino.cur.a8r.games (1) 336046 2021-05-15 15:15:03 UTC 2022-11-26 06:30:35 UTC 104.18.12.198
assets.customer.io (1) 19446 2013-05-31 17:10:04 UTC 2020-05-06 15:54:46 UTC 54.230.111.127
trc.taboola.com (1) 602 2013-07-11 10:17:31 UTC 2020-03-17 19:54:14 UTC 151.101.85.44
dwmu1hf7ovvid.cloudfront.net (115) 0 2022-06-02 17:28:59 UTC 2022-11-26 06:30:54 UTC 143.204.42.201 Unknown ranking
firefox.settings.services.mozilla.com (2) 867 2020-06-04 20:08:41 UTC 2022-11-26 05:33:20 UTC 34.102.187.140
img-getpocket.cdn.mozilla.net (7) 1631 2018-06-21 23:36:00 UTC 2020-02-19 04:43:25 UTC 34.120.237.76
fonts.gstatic.com (1) 0 2014-09-09 00:40:21 UTC 2022-11-26 10:10:14 UTC 216.58.207.195 Domain (gstatic.com) ranked at: 540
track.trackingtraffo.com (2) 0 No data No data 88.214.206.175 Unknown ranking
secure.adnxs.com (3) 396 2012-05-22 16:37:37 UTC 2020-03-11 07:38:04 UTC 185.89.210.101
ocsp.digicert.com (19) 86 2012-05-21 07:02:23 UTC 2020-05-02 20:58:10 UTC 93.184.220.29
cdn.onesignal.com (1) 3015 2015-04-22 13:41:50 UTC 2022-11-26 05:57:54 UTC 104.18.226.52
www.googletagmanager.com (1) 75 2013-05-22 02:07:37 UTC 2022-11-26 11:26:18 UTC 142.250.74.168
ctrack.trafficjunky.net (1) 27301 2014-03-23 22:43:38 UTC 2022-11-26 06:52:16 UTC 66.254.114.89
api.livechatinc.com (4) 5353 2013-12-20 14:27:35 UTC 2020-05-14 13:42:22 UTC 23.36.79.16
main.exdynsrv.com (1) 91821 2018-06-22 13:05:36 UTC 2020-03-31 04:40:59 UTC 95.211.229.245
dsp-media.eskimi.com (1) 46408 2015-12-29 16:38:43 UTC 2022-01-25 11:30:48 UTC 194.242.11.186
api.livechatinc.com (4) 5353 2013-12-20 14:27:35 UTC 2020-05-14 13:42:22 UTC 23.36.79.17
track.customer.io (1) 14241 2013-04-18 16:24:21 UTC 2020-03-09 23:23:59 UTC 35.227.225.220
contile.services.mozilla.com (1) 1114 2021-05-27 18:32:35 UTC 2022-11-26 05:33:16 UTC 34.117.237.239
20media.world (1) 501352 2020-09-18 08:05:58 UTC 2022-11-26 07:38:52 UTC 104.26.3.3
my.rtmark.net (1) 9054 2017-08-22 14:11:49 UTC 2022-11-26 05:56:01 UTC 139.45.195.8
mc.yandex.ru (3) 2672 2012-05-21 09:38:30 UTC 2022-11-26 05:59:03 UTC 93.158.134.119
cdn.livechatinc.com (5) 6288 2012-06-22 08:37:34 UTC 2020-04-29 06:44:28 UTC 23.36.79.16
20bet.com (51) 249292 2017-09-02 02:41:52 UTC 2022-11-26 11:58:15 UTC 104.22.34.208
ocsp.entrust.net (2) 1208 2014-01-10 02:18:45 UTC 2020-04-24 21:44:37 UTC 104.110.10.32
region1.google-analytics.com (1) 0 2022-03-17 11:26:33 UTC 2022-11-26 08:39:14 UTC 216.239.34.36 Domain (google-analytics.com) ranked at: 8401
ws-cdn001.akamaized.net (1) 188179 No data No data 23.36.77.10
ocsp.sectigo.com (5) 487 2019-11-29 11:50:24 UTC 2021-09-17 20:05:40 UTC 104.18.32.68
vars.hotjar.com (1) 1014 2020-11-05 10:13:14 UTC 2022-11-26 06:10:23 UTC 143.204.55.118
tsyndicate.com (1) 13042 2017-03-16 09:04:54 UTC 2022-11-26 11:12:57 UTC 162.55.130.248
match.sharethrough.com (3) 604 2016-10-07 22:49:32 UTC 2020-04-24 05:52:36 UTC 18.159.205.223
accounts.livechatinc.com (1) 7698 2018-09-03 02:09:14 UTC 2020-01-31 06:28:20 UTC 23.36.79.16
r3.o.lencr.org (9) 344 No data No data 23.36.77.32
ocsp.pki.goog (11) 175 2018-07-01 06:43:07 UTC 2020-05-02 20:58:16 UTC 142.250.74.3
c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com (4) 580028 No data No data 54.230.111.125
tracker.ads.sportradar.com (2) 41720 No data No data 23.36.79.43
tag.growthbuddy.app (1) 470040 2020-11-30 13:00:05 UTC 2022-11-26 06:30:37 UTC 54.74.8.139
content-signature-2.cdn.mozilla.net (1) 1152 No data No data 34.160.144.191
www.google-analytics.com (1) 40 2012-10-03 01:04:21 UTC 2022-11-26 11:34:11 UTC 142.250.74.174
static.cloudflareinsights.com (1) 1294 2019-09-24 14:34:56 UTC 2022-11-26 06:34:40 UTC 104.16.57.101
a.sportradarserving.com (4) 2372 No data No data 3.121.170.91
main.exoclick.com (1) 33599 2015-09-01 10:25:49 UTC 2020-03-31 04:40:59 UTC 95.211.229.246
push.services.mozilla.com (1) 2140 2014-10-24 08:27:06 UTC 2020-05-03 10:09:39 UTC 44.238.202.79
aze.bkin-8443.space (4) 0 2022-08-16 01:19:20 UTC 2022-09-20 14:02:33 UTC 104.21.81.37 Unknown ranking
tm.ads.sportradar.com (1) 40177 No data No data 23.36.79.43
fonts.googleapis.com (1) 8877 2013-06-10 20:14:26 UTC 2022-11-26 07:22:52 UTC 142.250.74.10
platform.20bet.com (32) 784200 2019-11-07 07:49:18 UTC 2022-11-26 12:19:04 UTC 104.22.34.208
platform.20bet.com (32) 784200 2019-11-07 07:49:18 UTC 2022-11-26 12:19:04 UTC 172.67.15.187
cdn.softswiss.net (76) 412286 2015-07-09 16:04:37 UTC 2022-11-26 09:49:40 UTC 104.17.115.131
aswpsdkus.com (1) 5300 2019-03-19 12:39:22 UTC 2022-11-26 11:34:44 UTC 34.160.158.95
ocsp.sca1b.amazontrust.com (5) 1015 2017-03-03 15:20:51 UTC 2019-03-27 04:05:54 UTC 143.204.42.156
static.hotjar.com (1) 641 2014-11-01 05:14:27 UTC 2020-04-26 08:32:02 UTC 54.230.111.8
a.exoclick.com (1) 71579 No data No data 205.185.216.10
ocsp.globalsign.com (1) 2075 2012-07-20 17:46:16 UTC 2020-05-02 20:58:10 UTC 104.18.20.226
zz.connextra.com (2) 14652 2014-03-20 17:05:16 UTC 2020-03-18 19:26:33 UTC 104.85.191.64
tracker.growthbuddy.app (1) 153665 2020-11-30 13:00:07 UTC 2022-11-26 06:30:37 UTC 54.74.8.139
x.bidswitch.net (5) 286 2017-08-28 15:21:00 UTC 2021-09-28 10:50:41 UTC 52.29.215.78
www.gstatic.com (1) 0 2016-07-26 09:37:06 UTC 2022-11-26 09:57:59 UTC 142.250.74.163 Domain (gstatic.com) ranked at: 540
aze.bkin-8443.space (4) 0 2022-08-16 01:19:20 UTC 2022-09-20 14:02:33 UTC 172.67.188.40 Unknown ranking
tags.feedad.com (1) 26948 2019-10-23 18:30:02 UTC 2022-11-26 07:03:54 UTC 216.239.36.21
www.facebook.com (2) 99 2012-05-21 00:23:41 UTC 2021-06-08 06:38:51 UTC 31.13.72.36
connect.facebook.net (1) 139 2012-05-22 02:51:28 UTC 2020-02-17 13:26:09 UTC 31.13.72.12
eb2.3lift.com (1) 402 2014-09-24 15:03:42 UTC 2020-03-13 01:44:01 UTC 13.248.245.213
dsp-trk.eskimi.com (1) 38619 2019-10-03 08:08:12 UTC 2022-11-26 05:58:55 UTC 34.120.139.69
www.google.com (1) 7 2016-03-22 03:56:07 UTC 2022-11-26 09:58:02 UTC 142.250.74.164
secure.livechatinc.com (1) 6541 2012-08-20 19:27:12 UTC 2020-04-07 20:28:05 UTC 23.36.79.16

Network Intrusion Detection Systemsinfo

Suricata /w Emerging Threats Pro
 No alerts detected

Blocklists

OpenPhish
 No alerts detected

PhishTank
 No alerts detected

Fortinet's Web Filter
Scan Date Severity Indicator Comment
2022-11-26 2 aze.bkin-8443.space/ Malware
2022-11-26 2 aze.bkin-8443.space/ Malware
2022-11-26 2 c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com/sealassets/73 (...) Malware
2022-11-26 2 c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com/apg-seal.js Malware
2022-11-26 2 aze.bkin-8443.space/ Malware

mnemonic secure dns
 No alerts detected

Quad9 DNS
 No alerts detected


Files

No files detected

Recent reports on same IP/ASN/Domain/Screenshot

Last 3 reports on IP: 172.67.188.40
Date UQ / IDS / BL URL IP
2022-12-26 07:41:35 +0000 0 - 2 - 2 mark.piteee.top/ 172.67.188.40
2022-11-26 15:49:00 +0000 0 - 0 - 5 aze.bkin-8443.space/ 172.67.188.40
2022-09-06 15:58:12 +0000 0 - 0 - 4 az.bkin-8443.space/420.html 172.67.188.40


Last 5 reports on ASN: CLOUDFLARENET
Date UQ / IDS / BL URL IP
2023-01-30 18:48:21 +0000 0 - 0 - 5 en.y2mate.is/153/ 104.21.4.123
2023-01-30 18:47:30 +0000 0 - 1 - 0 www.1001freefonts.com/de/d/42431/passion-flow (...) 104.26.0.140
2023-01-30 18:47:34 +0000 0 - 1 - 0 cdn.discordapp.com/attachments/10696838657209 (...) 162.159.134.233
2023-01-30 18:46:08 +0000 0 - 1 - 0 cdn.discordapp.com/attachments/10692281179206 (...) 162.159.133.233
2023-01-30 18:45:48 +0000 0 - 2 - 0 cdn.discordapp.com/attachments/10674791536847 (...) 162.159.129.233


Last 2 reports on domain: bkin-8443.space
Date UQ / IDS / BL URL IP
2022-11-26 15:49:00 +0000 0 - 0 - 5 aze.bkin-8443.space/ 172.67.188.40
2022-09-06 15:58:12 +0000 0 - 0 - 4 az.bkin-8443.space/420.html 172.67.188.40


No other reports with similar screenshot

JavaScript

Executed Scripts (94)

Executed Evals (5)
#1 JavaScript::Eval (size: 15588) - SHA256: 0d4559ba47020dfb3d3229a79fae241152a0337f86a9c8a01bd5add41c1753b7
/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t */
(function() {
    var y = this || self,
        e = function(R) {
            return R
        },
        q = function(R, n) {
            if ((n = (R = y.trustedTypes, null), !R) || !R.createPolicy) return n;
            try {
                n = R.createPolicy("bg", {
                    createHTML: e,
                    createScript: e,
                    createScriptURL: e
                })
            } catch (k) {
                y.console && y.console.error(k.message)
            }
            return n
        };
    (0, eval)(function(R, n) {
        return (n = q()) && 1 === R.eval(n.createScript("1")) ? function(k) {
            return n.createScript(k)
        } : function(k) {
            return "" + k
        }
    }(y)(Array(7824 * Math.random() | 0).join("\n") + '(function(){var p=function(R,n,k){k[V(R,n,k),Rl]=2796},nX=function(R,n){return R(function(k){k(n)}),[function(){return n}]},kz=function(R,n,k,q,c){for(n=(q=(c=n[3]|0,0),n[2])|0;14>q;q++)c=c>>>8|c<<24,k=k>>>8|k<<24,k+=R|0,c+=n|0,k^=n+2298,R=R<<3|R>>>29,c^=q+2298,R^=k,n=n<<3|n>>>29,n^=c;return[R>>>24&255,R>>>16&255,R>>>8&255,R>>>0&255,k>>>24&255,k>>>16&255,k>>>8&255,k>>>0&255]},E,L=function(R,n,k,q,c,y,e,K,N,Q,Z,w,U,h){if(y=v(n,278),y>=n.B)throw[x,31];for(c=(K=0,q=R,Q=y,n.c0.length);0<q;)Z=Q%8,N=8-(Z|0),N=N<q?N:q,U=Q>>3,w=n.i[U],k&&(e=n,e.A!=Q>>6&&(e.A=Q>>6,h=v(e,358),e.l=kz(e.O,[0,0,h[1],h[2]],e.A)),w^=n.l[U&c]),K|=(w>>8-(Z|0)-(N|0)&(1<<N)-1)<<(q|0)-(N|0),Q+=N,q-=N;return V(278,n,(k=K,(y|0)+(R|0))),k},yB=function(R,n,k,q){try{q=R[((n|0)+2)%3],R[n]=(R[n]|0)-(R[((n|0)+1)%3]|0)-(q|0)^(1==n?q<<k:q>>>k)}catch(c){throw c;}},eM=function(R,n){return n=P(R),n&128&&(n=n&127|P(R)<<7),n},qX=function(R,n,k){if((n=typeof R,"object")==n)if(R){if(R instanceof Array)return"array";if(R instanceof Object)return n;if("[object Window]"==(k=Object.prototype.toString.call(R),k))return"object";if("[object Array]"==k||"number"==typeof R.length&&"undefined"!=typeof R.splice&&"undefined"!=typeof R.propertyIsEnumerable&&!R.propertyIsEnumerable("splice"))return"array";if("[object Function]"==k||"undefined"!=typeof R.call&&"undefined"!=typeof R.propertyIsEnumerable&&!R.propertyIsEnumerable("call"))return"function"}else return"null";else if("function"==n&&"undefined"==typeof R.call)return"object";return n},C=function(R,n){R.P.splice(0,0,n)},G=function(R,n,k,q,c,y){if(n.C==n)for(c=v(n,R),421==R?(R=function(e,K,N,Q){if(c.mm!=(Q=((K=c.length,K)|0)-4>>3,Q)){Q=(c.mm=(N=[0,0,y[1],y[2]],Q),(Q<<3)-4);try{c.nk=kz(KX(c,Q),N,KX(c,(Q|0)+4))}catch(Z){throw Z;}}c.push(c.nk[K&7]^e)},y=v(n,408)):R=function(e){c.push(e)},q&&R(q&255),n=k.length,q=0;q<n;q++)R(k[q])},NX=function(R,n,k,q){for(;R.P.length;){k=(R.F=null,R).P.pop();try{q=ca(R,k)}catch(c){r(R,c)}if(n&&R.F){n=R.F,n(function(){B(true,R,true)});break}}return q},QB=function(R,n,k,q){return(q=I[R.substring(0,3)+"_"])?q(R.substring(3),n,k):nX(n,R)},sk=function(R,n,k,q,c){G(((c=(k=u((c=u((q=n&4,n&=3,R)),R)),v(R,c)),q)&&(c=pX(""+c)),n&&G(k,R,D(2,c.length)),k),R,c)},l=function(R,n,k,q,c,y,e,K,N){if((R.C=(((K=(y=(N=(c=(e=0<(k||R.X++,R).U&&R.S&&R.xh&&1>=R.J&&!R.L&&!R.F&&(!k||1<R.Z-n)&&0==document.hidden,4==R.X))||e?R.s():R.T,N-R.T),y)>>14,R).O&&(R.O^=K*(y<<2)),R).Y+=K,K||R.C),c)||e)R.X=0,R.T=N;if(!e||N-R.H<R.U-(q?255:k?5:2))return false;return!((V(278,(q=v(R,(R.Z=n,k?426:278)),R),R.B),R.P).push([jM,q,k?n+1:n]),R.F=z,0)},Ek=function(R,n,k){if(3==R.length){for(k=0;3>k;k++)n[k]+=R[k];for(k=[(R=0,13),8,13,12,16,5,3,10,15];9>R;R++)n[3](n,R%3,k[R])}},u=function(R,n){if(R.L)return Zn(R,R.N);return n=L(8,R,true),n&128&&(n^=128,R=L(2,R,true),n=(n<<2)+(R|0)),n},KX=function(R,n){return R[n]<<24|R[(n|0)+1]<<16|R[(n|0)+2]<<8|R[(n|0)+3]},we=function(R,n,k,q,c,y,e,K){return(c=d[n.I]((k=[-2,42,-72,-(y=va,46),-26,-71,k,61,(K=q&7,9),2],n.MJ)),c)[n.I]=function(N){e=N,K+=6+7*q,K&=7},c.concat=function(N){return(N=(e=(N=+(N=R%16+1,k)[K+59&7]*R*N-N*e- -2440*e+(y()|0)*N+1*R*R*N-2562*R*e-61*R*R*e+K+61*e*e,void 0),k[N]),k[(K+69&7)+(q&2)]=N,k)[K+(q&2)]=42,N},c},V=function(R,n,k){if(278==R||426==R)n.u[R]?n.u[R].concat(k):n.u[R]=h8(n,k);else{if(n.D&&358!=R)return;305==R||421==R||352==R||236==R||408==R?n.u[R]||(n.u[R]=we(R,n,k,54)):n.u[R]=we(R,n,k,113)}358==R&&(n.O=L(32,n,false),n.A=void 0)},P=function(R){return R.L?Zn(R,R.N):L(8,R,true)},B=function(R,n,k,q,c,y){if(n.P.length){(n.S=!(n.S&&0(),0),n).xh=k;try{q=n.s(),n.H=q,n.T=q,n.X=0,c=NX(n,k),y=n.s()-n.H,n.G+=y,y<(R?0:10)||0>=n.g--||(y=Math.floor(y),n.K.push(254>=y?y:254))}finally{n.S=false}return c}},xz=function(R,n,k,q){for(k=(q=u(n),0);0<R;R--)k=k<<8|P(n);V(q,n,k)},I,Pa=function(R,n,k,q){return v(R,(LX((q=v(R,278),R.i&&q<R.B?(V(278,R,R.B),Uk(k,R)):V(278,R,k),n),R),V(278,R,q),15))},Tu=function(R,n,k,q,c){for(c=(q=(k.In=(k.MJ=J8(k.I,(k.v0=(k.NJ=be,CX),k.c0=k[F],{get:function(){return this.concat()}})),d)[k.I](k.MJ,{value:{value:{}}}),[]),0);128>c;c++)q[c]=String.fromCharCode(c);B((C((C(k,(C(k,(p(340,(V((V(305,k,[160,((V(307,(V(327,(V(236,k,(p(59,k,(p(127,k,(p(119,(V(421,k,(V(270,k,(p(87,(p(158,(p(396,k,(p(448,k,(k.on=(p(362,(k.E9=(p((p(250,k,(p(371,(V(15,(p(354,k,(V(352,k,((p(442,k,(p(227,k,(p(103,k,(p(11,k,(p(121,(V(289,(p(173,(V(409,k,(p(275,k,(p(317,(p(375,k,(p(432,((p((p(295,(V(278,k,(k.B0=(k.wE=(k.P0=function(y){this.C=y},k.u=(k.R=void 0,[]),k.F=((k.O=(k.N=void 0,void 0),k.Y=1,k.U=0,(k.Rn=[],k).C=k,c=window.performance||{},k.j=[],(k.J=0,k).T=0,k.B=0,k.S=((k.A=void 0,k.X=void 0,k).i=[],k.H=(k.P=(k.xh=false,[]),k.g=(k.G=0,25),0),k.L=(k.l=void 0,void 0),k.D=false,k.Z=8001,false),k).K=[],null),0),c).timeOrigin||(c.timing||{}).navigationStart||0,0)),V(426,k,0),k),function(y,e,K,N){V((e=v(y,(N=(K=(N=(e=u(y),u(y)),u(y)),v(y,N)),e)),K),y,e in N|0)}),163),k,function(y,e,K,N){!l(y,e,true,false)&&(e=re(y),N=e.Ck,K=e.h,y.C==y||K==y.P0&&N==y)&&(V(e.un,y,K.apply(N,e.o)),y.T=y.s())}),p)(341,k,function(y,e,K,N){if(N=y.Rn.pop()){for(K=P(y);0<K;K--)e=u(y),N[e]=y.u[e];y.u=(N[236]=y.u[236],N[307]=y.u[307],N)}else V(278,y,y.B)}),k),function(y,e){(e=v(y,u(y)),Uk)(e,y.C)}),function(y,e,K,N){(e=v(y,(N=v((K=(N=u((e=u(y),y)),u(y)),y),N),e))==N,V)(K,y,+e)})),k),function(y){xz(4,y)}),function(y,e,K,N,Q,Z){if(!l(y,e,true,true)){if("object"==(y=v((N=(Q=v((e=v((N=(e=(Q=(Z=u(y),u)(y),u(y)),u)(y),y),e),y),Q),v(y,N)),y),Z),qX)(y)){for(K in Z=[],y)Z.push(K);y=Z}for(Z=(e=0<e?e:1,K=y.length,0);Z<K;Z+=e)Q(y.slice(Z,(Z|0)+(e|0)),N)}})),p(193,k,function(y,e,K,N,Q){0!==(Q=v(y,(K=(e=v((N=v(y,(N=(Q=u((K=u(y),y)),e=u(y),u(y)),N)),y),e),v(y.C,K)),Q)),K)&&(N=Ba(e,N,y,1,K,Q),K.addEventListener(Q,N,W),V(270,y,[K,Q,N]))}),687)),k),function(y){sk(y,4)}),k),0),k),function(){}),function(y,e,K,N,Q,Z,w){for(w=(e=(K=(N=u(y),Z=eM(y),Q="",v(y,115)),K.length),0);Z--;)w=((w|0)+(eM(y)|0))%e,Q+=q[K[w]];V(N,y,Q)})),function(y,e,K){K=v((e=(K=(e=u(y),u(y)),0!=v(y,e)),y),K),e&&V(278,y,K)})),function(y,e,K,N,Q){for(K=(e=(N=u(y),eM)(y),0),Q=[];K<e;K++)Q.push(P(y));V(N,y,Q)})),function(y,e,K){(e=u((K=u(y),y)),V)(e,y,""+v(y,K))})),V)(408,k,[0,0,0]),[])),function(y,e,K,N,Q,Z,w,U,h,T,Y,J){function f(b,a){for(;e<b;)T|=P(y)<<e,e+=8;return T>>=(a=T&(e-=b,(1<<b)-1),b),a}for(K=(h=(U=(Y=(e=T=(Z=u(y),0),f(3)|0)+1,f(5)),0),[]),Q=0;Q<U;Q++)J=f(1),K.push(J),h+=J?0:1;for(Q=(N=(h=((h|0)-1).toString(2).length,[]),0);Q<U;Q++)K[Q]||(N[Q]=f(h));for(h=0;h<U;h++)K[h]&&(N[h]=u(y));for(w=[];Y--;)w.push(v(y,u(y)));p(Z,y,function(b,a,O,VB,X){for(O=(VB=(X=[],[]),0);O<U;O++){if(a=N[O],!K[O]){for(;a>=X.length;)X.push(u(b));a=X[a]}VB.push(a)}b.L=h8(b,w.slice()),b.N=h8(b,VB)})})),k),{}),k),function(y){al(y,1)}),function(y,e,K){l(y,e,true,false)||(e=u(y),K=u(y),V(K,y,function(N){return eval(N)}(Gu(v(y.C,e)))))})),499),k,function(y){sk(y,3)}),0),k),function(y,e,K,N){K=(N=P((e=u(y),y)),u(y)),V(K,y,v(y,e)>>>N)}),0),function(y,e,K,N){V((e=v(y,(N=v(y,(K=u((N=u(y),y)),N)),K)),K),y,e+N)})),function(y,e){y=(e=u(y),v)(y.C,e),y[0].removeEventListener(y[1],y[2],W)})),k),function(y,e,K,N,Q){V((K=v(y,(N=(Q=v(y,(Q=(N=(K=(e=u(y),u(y)),u(y)),u)(y),Q)),v(y,N)),K)),e),y,Ba(K,N,y,Q))}),k),function(y,e,K){V((K=v(y,(e=(K=u(y),u(y)),K)),K=qX(K),e),y,K)}),0)),S(4))),k),function(y,e,K,N,Q,Z){l(y,e,true,false)||(N=re(y.C),e=N.o,Z=N.Ck,Q=N.h,K=e.length,N=N.un,e=0==K?new Z[Q]:1==K?new Z[Q](e[0]):2==K?new Z[Q](e[0],e[1]):3==K?new Z[Q](e[0],e[1],e[2]):4==K?new Z[Q](e[0],e[1],e[2],e[3]):2(),V(N,y,e))}),function(y,e,K,N){N=u((e=u(y),y)),K=u(y),y.C==y&&(N=v(y,N),K=v(y,K),v(y,e)[N]=K,358==e&&(y.A=void 0,2==N&&(y.O=L(32,y,false),y.A=void 0)))})),function(y){al(y,4)})),[])),k),H),k),2048),k).an=0,0),0]),120),k,k),k),function(y,e,K,N){V((K=v((e=v(y,(N=u((K=u((e=u(y),y)),y)),e)),y),K),N),y,e[K])}),p(472,k,function(y,e,K,N){N=(e=u(y),u)(y),K=u(y),V(K,y,v(y,e)||v(y,N))}),[Rl])),[A,n])),k),[Il,R]),true),k,true)},J8=function(R,n){return d[R](d.prototype,{pop:n,replace:n,length:n,document:n,splice:n,parent:n,stack:n,floor:n,prototype:n,console:n,call:n,propertyIsEnumerable:n})},pX=function(R,n,k,q,c){for(q=(R=R.replace(/\\r\\n/g,"\\n"),n=0,[]),k=0;n<R.length;n++)c=R.charCodeAt(n),128>c?q[k++]=c:(2048>c?q[k++]=c>>6|192:(55296==(c&64512)&&n+1<R.length&&56320==(R.charCodeAt(n+1)&64512)?(c=65536+((c&1023)<<10)+(R.charCodeAt(++n)&1023),q[k++]=c>>18|240,q[k++]=c>>12&63|128):q[k++]=c>>12|224,q[k++]=c>>6&63|128),q[k++]=c&63|128);return q},LX=function(R,n,k,q,c,y){if(!n.R){n.J++;try{for(k=(q=(y=void 0,n).B,0);--R;)try{if((c=void 0,n).L)y=Zn(n,n.L);else{if(k=v(n,278),k>=q)break;y=(c=(V(426,n,k),u(n)),v)(n,c)}(y&&y[ue]&2048?y(n,R):M(n,0,[x,21,c]),l)(n,R,false,false)}catch(e){v(n,409)?M(n,22,e):V(409,n,e)}if(!R){if(n.Lk){n.J--,LX(338687074593,n);return}M(n,0,[x,33])}}catch(e){try{M(n,22,e)}catch(K){r(n,K)}}n.J--}},Zn=function(R,n){return(n=n.create().shift(),R.L.create()).length||R.N.create().length||(R.L=void 0,R.N=void 0),n},Dn=function(R,n,k,q){function c(){}return{invoke:(k=QB((q=void 0,R),function(y){c&&(n&&z(n),q=y,c(),c=void 0)},!!n)[0],function(y,e,K,N){function Q(){q(function(Z){z(function(){y(Z)})},K)}if(!e)return e=k(K),y&&y(e),e;q?Q():(N=c,c=function(){N(),z(Q)})})}},v=function(R,n){if(void 0===(R=R.u[n],R))throw[x,30,n];if(R.value)return R.create();return R.create(1*n*n+42*n+-40),R.prototype},D=function(R,n,k,q){for(k=(q=(R|0)-1,[]);0<=q;q--)k[(R|0)-1-(q|0)]=n>>8*q&255;return k},Uk=function(R,n){V(278,((n.Rn.push(n.u.slice()),n.u)[278]=void 0,n),R)},r=function(R,n){R.R=((R.R?R.R+"~":"E:")+n.message+":"+n.stack).slice(0,2048)},fX=function(R,n,k){return n.W(function(q){k=q},false,R),k},Ba=function(R,n,k,q,c,y){function e(){if(k.C==k){if(k.u){var K=[m,R,n,void 0,c,y,arguments];if(2==q)var N=B(false,(C(k,K),k),false);else if(1==q){var Q=!k.P.length;C(k,K),Q&&B(false,k,false)}else N=ca(k,K);return N}c&&y&&c.removeEventListener(y,e,W)}}return e},S=function(R,n){for(n=[];R--;)n.push(255*Math.random()|0);return n},ca=function(R,n,k,q,c){if(c=n[0],c==g)R.g=25,R.v(n);else if(c==F){q=n[1];try{k=R.R||R.v(n)}catch(y){r(R,y),k=R.R}q(k)}else if(c==jM)R.v(n);else if(c==A)R.v(n);else if(c==Il){try{for(k=0;k<R.j.length;k++)try{q=R.j[k],q[0][q[1]](q[2])}catch(y){}}catch(y){}(0,n[R.j=[],1])(function(y,e){R.W(y,true,e)},function(y){(C((y=!R.P.length,R),[ue]),y)&&B(false,R,true)})}else{if(c==m)return k=n[2],V(126,R,n[6]),V(15,R,k),R.v(n);c==ue?(R.K=[],R.i=[],R.u=null):c==Rl&&"loading"===H.document.readyState&&(R.F=function(y,e){function K(){e||(e=true,y())}H.document.addEventListener("DOMContentLoaded",(e=false,K),W),H.addEventListener("load",K,W)})}},al=function(R,n,k,q){G((k=u(R),q=u(R),q),R,D(n,v(R,k)))},$z=function(R,n){if((R=null,n=H.trustedTypes,!n)||!n.createPolicy)return R;try{R=n.createPolicy("bg",{createHTML:zu,createScript:zu,createScriptURL:zu})}catch(k){H.console&&H.console.error(k.message)}return R},zu=function(R){return R},M=function(R,n,k,q,c,y){if(!R.D){if((k=v(R,(n=(0==(q=((c=void 0,k&&k[0]===x)&&(c=k[2],n=k[1],k=void 0),v)(R,236),q).length&&(y=v(R,426)>>3,q.push(n,y>>8&255,y&255),void 0!=c&&q.push(c&255)),""),k&&(k.message&&(n+=k.message),k.stack&&(n+=":"+k.stack)),307)),3)<k){R.C=(c=(n=pX((k-=((n=n.slice(0,(k|0)-3),n.length)|0)+3,n)),R.C),R);try{G(421,R,D(2,n.length).concat(n),9)}finally{R.C=c}}V(307,R,k)}},H=this||self,t=function(R,n,k){k=this;try{Tu(n,R,this)}catch(q){r(this,q),n(function(c){c(k.R)})}},h8=function(R,n,k){return k=d[R.I](R.In),k[R.I]=function(){return n},k.concat=function(q){n=q},k},W={passive:true,capture:true},re=function(R,n,k,q,c,y){for(q=(c=(n=(k=u((y=R[le]||{},R)),y.un=u(R),y.o=[],R.C==R?(P(R)|0)-1:1),u(R)),0);q<n;q++)y.o.push(u(R));for(y.Ck=v(R,c);n--;)y.o[n]=v(R,y.o[n]);return y.h=v(R,k),y},z=H.requestIdleCallback?function(R){requestIdleCallback(function(){R()},{timeout:4})}:H.setImmediate?function(R){setImmediate(R)}:function(R){setTimeout(R,0)},de=function(R,n){n.push(R[0]<<24|R[1]<<16|R[2]<<8|R[3]),n.push(R[4]<<24|R[5]<<16|R[6]<<8|R[7]),n.push(R[8]<<24|R[9]<<16|R[10]<<8|R[11])},le=String.fromCharCode(105,110,116,101,103,67,104,101,99,107,66,121,112,97,115,115),x=((t.prototype.V="toString",t.prototype.Lk=false,t).prototype.Qy=void 0,{}),g=[],Il=[],jM=[],A=[],m=[],ue=(t.prototype.kh=void 0,[]),F=[],Rl=[],d=(E=((de,function(){})(S),yB,Ek,t.prototype),E.zc=function(){return Math.floor(this.G+(this.s()-this.H))},x.constructor),va=(E.s=(t.prototype.I="create",(E.dE=(E.W=function(R,n,k,q,c){if((k="array"===qX(k)?k:[k],this).R)R(this.R);else try{q=!this.P.length,c=[],C(this,[g,c,k]),C(this,[F,R,c]),n&&!q||B(true,this,n)}catch(y){r(this,y),R(this.R)}},function(R,n,k,q,c,y){for(c=q=0,y=[];q<R.length;q++)for(c+=n,k=k<<n|R[q];7<c;)c-=8,y.push(k>>c&255);return y}),(E.eN=(E.s9=function(R,n,k){return((n=(n^=n<<13,n^=n>>17,(n^n<<5)&k))||(n=1),R)^n},function(R,n,k,q,c){for(q=c=0;c<R.length;c++)q+=R.charCodeAt(c),q+=q<<10,q^=q>>6;return c=new Number((q+=q<<3,q^=q>>11,R=q+(q<<15)>>>0,R&(1<<n)-1)),c[0]=(R>>>n)%k,c}),E.FH=function(){return Math.floor(this.s())},window.performance||{}).now)?function(){return this.B0+window.performance.now()}:function(){return+new Date}),void 0),CX=((t.prototype.v=function(R,n){return n={},va=(R={},function(){return n==R?-40:9}),function(k,q,c,y,e,K,N,Q,Z,w,U,h,T,Y,J){n=(Y=n,R);try{if(h=k[0],h==A){T=k[1];try{for(Q=(y=atob(T),e=[],K=0);Q<y.length;Q++)J=y.charCodeAt(Q),255<J&&(e[K++]=J&255,J>>=8),e[K++]=J;V(358,this,(this.B=(this.i=e,this.i).length<<3,[0,0,0]))}catch(f){M(this,17,f);return}LX(8001,this)}else if(h==g)k[1].push(v(this,307),v(this,421).length,v(this,352).length,v(this,305).length),V(15,this,k[2]),this.u[349]&&Pa(this,8001,v(this,349));else{if(h==F){this.C=(Z=(U=D(2,(v(this,(K=k[2],305)).length|0)+2),this.C),this);try{w=v(this,236),0<w.length&&G(305,this,D(2,w.length).concat(w),10),G(305,this,D(1,this.Y),109),G(305,this,D(1,this[F].length)),y=0,y-=(v(this,305).length|0)+5,y+=v(this,289)&2047,q=v(this,421),4<q.length&&(y-=(q.length|0)+3),0<y&&G(305,this,D(2,y).concat(S(y)),15),4<q.length&&G(305,this,D(2,q.length).concat(q),156)}finally{this.C=Z}if(c=((Q=S(2).concat(v(this,305)),Q[1]=Q[0]^6,Q[3]=Q[1]^U[0],Q)[4]=Q[1]^U[1],this.rE(Q)))c="!"+c;else for(c="",y=0;y<Q.length;y++)N=Q[y][this.V](16),1==N.length&&(N="0"+N),c+=N;return v(this,(v((v((V(307,this,(e=c,K.shift())),this),421).length=K.shift(),this),352).length=K.shift(),305)).length=K.shift(),e}if(h==jM)Pa(this,k[2],k[1]);else if(h==m)return Pa(this,8001,k[1])}}finally{n=Y}}}(),t.prototype).rE=function(R,n,k,q){if(n=window.btoa){for(q=(k=0,"");k<R.length;k+=8192)q+=String.fromCharCode.apply(null,R.slice(k,k+8192));R=n(q).replace(/\\+/g,"-").replace(/\\//g,"_").replace(/=/g,"")}else R=void 0;return R},/./);(t.prototype.Ax=0,t.prototype).yy=0;var be,Fn=A.pop.bind((t.prototype[Il]=[0,0,1,1,0,1,1],t).prototype[g]),Gu=function(R,n){return(n=$z())&&1===R.eval(n.createScript("1"))?function(k){return n.createScript(k)}:function(k){return""+k}}(((be=J8(t.prototype.I,{get:(CX[t.prototype.V]=Fn,Fn)}),t.prototype).O9=void 0,H));40<(I=H.botguard||(H.botguard={}),I.m)||(I.m=41,I.bg=Dn,I.a=QB),I.bDL_=function(R,n,k){return k=new t(R,n),[function(q){return fX(q,k)}]};}).call(this);'));
}).call(this);
#2 JavaScript::Eval (size: 22816) - SHA256: 32c81855d437640ca2e3151b13ed3d9006ee5730541a558413b4dec46f6d5b23
(function() {
    var p = function(R, n, k) {
            k[V(R, n, k), Rl] = 2796
        },
        nX = function(R, n) {
            return R(function(k) {
                k(n)
            }), [function() {
                return n
            }]
        },
        kz = function(R, n, k, q, c) {
            for (n = (q = (c = n[3] | 0, 0), n[2]) | 0; 14 > q; q++) c = c >>> 8 | c << 24, k = k >>> 8 | k << 24, k += R | 0, c += n | 0, k ^= n + 2298, R = R << 3 | R >>> 29, c ^= q + 2298, R ^= k, n = n << 3 | n >>> 29, n ^= c;
            return [R >>> 24 & 255, R >>> 16 & 255, R >>> 8 & 255, R >>> 0 & 255, k >>> 24 & 255, k >>> 16 & 255, k >>> 8 & 255, k >>> 0 & 255]
        },
        E, L = function(R, n, k, q, c, y, e, K, N, Q, Z, w, U, h) {
            if (y = v(n, 278), y >= n.B) throw [x, 31];
            for (c = (K = 0, q = R, Q = y, n.c0.length); 0 < q;) Z = Q % 8, N = 8 - (Z | 0), N = N < q ? N : q, U = Q >> 3, w = n.i[U], k && (e = n, e.A != Q >> 6 && (e.A = Q >> 6, h = v(e, 358), e.l = kz(e.O, [0, 0, h[1], h[2]], e.A)), w ^= n.l[U & c]), K |= (w >> 8 - (Z | 0) - (N | 0) & (1 << N) - 1) << (q | 0) - (N | 0), Q += N, q -= N;
            return V(278, n, (k = K, (y | 0) + (R | 0))), k
        },
        yB = function(R, n, k, q) {
            try {
                q = R[((n | 0) + 2) % 3], R[n] = (R[n] | 0) - (R[((n | 0) + 1) % 3] | 0) - (q | 0) ^ (1 == n ? q << k : q >>> k)
            } catch (c) {
                throw c;
            }
        },
        eM = function(R, n) {
            return n = P(R), n & 128 && (n = n & 127 | P(R) << 7), n
        },
        qX = function(R, n, k) {
            if ((n = typeof R, "object") == n)
                if (R) {
                    if (R instanceof Array) return "array";
                    if (R instanceof Object) return n;
                    if ("[object Window]" == (k = Object.prototype.toString.call(R), k)) return "object";
                    if ("[object Array]" == k || "number" == typeof R.length && "undefined" != typeof R.splice && "undefined" != typeof R.propertyIsEnumerable && !R.propertyIsEnumerable("splice")) return "array";
                    if ("[object Function]" == k || "undefined" != typeof R.call && "undefined" != typeof R.propertyIsEnumerable && !R.propertyIsEnumerable("call")) return "function"
                } else return "null";
            else if ("function" == n && "undefined" == typeof R.call) return "object";
            return n
        },
        C = function(R, n) {
            R.P.splice(0, 0, n)
        },
        G = function(R, n, k, q, c, y) {
            if (n.C == n)
                for (c = v(n, R), 421 == R ? (R = function(e, K, N, Q) {
                        if (c.mm != (Q = ((K = c.length, K) | 0) - 4 >> 3, Q)) {
                            Q = (c.mm = (N = [0, 0, y[1], y[2]], Q), (Q << 3) - 4);
                            try {
                                c.nk = kz(KX(c, Q), N, KX(c, (Q | 0) + 4))
                            } catch (Z) {
                                throw Z;
                            }
                        }
                        c.push(c.nk[K & 7] ^ e)
                    }, y = v(n, 408)) : R = function(e) {
                        c.push(e)
                    }, q && R(q & 255), n = k.length, q = 0; q < n; q++) R(k[q])
        },
        NX = function(R, n, k, q) {
            for (; R.P.length;) {
                k = (R.F = null, R).P.pop();
                try {
                    q = ca(R, k)
                } catch (c) {
                    r(R, c)
                }
                if (n && R.F) {
                    n = R.F, n(function() {
                        B(true, R, true)
                    });
                    break
                }
            }
            return q
        },
        QB = function(R, n, k, q) {
            return (q = I[R.substring(0, 3) + "_"]) ? q(R.substring(3), n, k) : nX(n, R)
        },
        sk = function(R, n, k, q, c) {
            G(((c = (k = u((c = u((q = n & 4, n &= 3, R)), R)), v(R, c)), q) && (c = pX("" + c)), n && G(k, R, D(2, c.length)), k), R, c)
        },
        l = function(R, n, k, q, c, y, e, K, N) {
            if ((R.C = (((K = (y = (N = (c = (e = 0 < (k || R.X++, R).U && R.S && R.xh && 1 >= R.J && !R.L && !R.F && (!k || 1 < R.Z - n) && 0 == document.hidden, 4 == R.X)) || e ? R.s() : R.T, N - R.T), y) >> 14, R).O && (R.O ^= K * (y << 2)), R).Y += K, K || R.C), c) || e) R.X = 0, R.T = N;
            if (!e || N - R.H < R.U - (q ? 255 : k ? 5 : 2)) return false;
            return !((V(278, (q = v(R, (R.Z = n, k ? 426 : 278)), R), R.B), R.P).push([jM, q, k ? n + 1 : n]), R.F = z, 0)
        },
        Ek = function(R, n, k) {
            if (3 == R.length) {
                for (k = 0; 3 > k; k++) n[k] += R[k];
                for (k = [(R = 0, 13), 8, 13, 12, 16, 5, 3, 10, 15]; 9 > R; R++) n[3](n, R % 3, k[R])
            }
        },
        u = function(R, n) {
            if (R.L) return Zn(R, R.N);
            return n = L(8, R, true), n & 128 && (n ^= 128, R = L(2, R, true), n = (n << 2) + (R | 0)), n
        },
        KX = function(R, n) {
            return R[n] << 24 | R[(n | 0) + 1] << 16 | R[(n | 0) + 2] << 8 | R[(n | 0) + 3]
        },
        we = function(R, n, k, q, c, y, e, K) {
            return (c = d[n.I]((k = [-2, 42, -72, -(y = va, 46), -26, -71, k, 61, (K = q & 7, 9), 2], n.MJ)), c)[n.I] = function(N) {
                e = N, K += 6 + 7 * q, K &= 7
            }, c.concat = function(N) {
                return (N = (e = (N = +(N = R % 16 + 1, k)[K + 59 & 7] * R * N - N * e - -2440 * e + (y() | 0) * N + 1 * R * R * N - 2562 * R * e - 61 * R * R * e + K + 61 * e * e, void 0), k[N]), k[(K + 69 & 7) + (q & 2)] = N, k)[K + (q & 2)] = 42, N
            }, c
        },
        V = function(R, n, k) {
            if (278 == R || 426 == R) n.u[R] ? n.u[R].concat(k) : n.u[R] = h8(n, k);
            else {
                if (n.D && 358 != R) return;
                305 == R || 421 == R || 352 == R || 236 == R || 408 == R ? n.u[R] || (n.u[R] = we(R, n, k, 54)) : n.u[R] = we(R, n, k, 113)
            }
            358 == R && (n.O = L(32, n, false), n.A = void 0)
        },
        P = function(R) {
            return R.L ? Zn(R, R.N) : L(8, R, true)
        },
        B = function(R, n, k, q, c, y) {
            if (n.P.length) {
                (n.S = !(n.S && 0(), 0), n).xh = k;
                try {
                    q = n.s(), n.H = q, n.T = q, n.X = 0, c = NX(n, k), y = n.s() - n.H, n.G += y, y < (R ? 0 : 10) || 0 >= n.g-- || (y = Math.floor(y), n.K.push(254 >= y ? y : 254))
                } finally {
                    n.S = false
                }
                return c
            }
        },
        xz = function(R, n, k, q) {
            for (k = (q = u(n), 0); 0 < R; R--) k = k << 8 | P(n);
            V(q, n, k)
        },
        I, Pa = function(R, n, k, q) {
            return v(R, (LX((q = v(R, 278), R.i && q < R.B ? (V(278, R, R.B), Uk(k, R)) : V(278, R, k), n), R), V(278, R, q), 15))
        },
        Tu = function(R, n, k, q, c) {
            for (c = (q = (k.In = (k.MJ = J8(k.I, (k.v0 = (k.NJ = be, CX), k.c0 = k[F], {get: function() {
                        return this.concat()
                    }
                })), d)[k.I](k.MJ, {
                    value: {
                        value: {}
                    }
                }), []), 0); 128 > c; c++) q[c] = String.fromCharCode(c);
            B((C((C(k, (C(k, (p(340, (V((V(305, k, [160, ((V(307, (V(327, (V(236, k, (p(59, k, (p(127, k, (p(119, (V(421, k, (V(270, k, (p(87, (p(158, (p(396, k, (p(448, k, (k.on = (p(362, (k.E9 = (p((p(250, k, (p(371, (V(15, (p(354, k, (V(352, k, ((p(442, k, (p(227, k, (p(103, k, (p(11, k, (p(121, (V(289, (p(173, (V(409, k, (p(275, k, (p(317, (p(375, k, (p(432, ((p((p(295, (V(278, k, (k.B0 = (k.wE = (k.P0 = function(y) {
                this.C = y
            }, k.u = (k.R = void 0, []), k.F = ((k.O = (k.N = void 0, void 0), k.Y = 1, k.U = 0, (k.Rn = [], k).C = k, c = window.performance || {}, k.j = [], (k.J = 0, k).T = 0, k.B = 0, k.S = ((k.A = void 0, k.X = void 0, k).i = [], k.H = (k.P = (k.xh = false, []), k.g = (k.G = 0, 25), 0), k.L = (k.l = void 0, void 0), k.D = false, k.Z = 8001, false), k).K = [], null), 0), c).timeOrigin || (c.timing || {}).navigationStart || 0, 0)), V(426, k, 0), k), function(y, e, K, N) {
                V((e = v(y, (N = (K = (N = (e = u(y), u(y)), u(y)), v(y, N)), e)), K), y, e in N | 0)
            }), 163), k, function(y, e, K, N) {
                !l(y, e, true, false) && (e = re(y), N = e.Ck, K = e.h, y.C == y || K == y.P0 && N == y) && (V(e.un, y, K.apply(N, e.o)), y.T = y.s())
            }), p)(341, k, function(y, e, K, N) {
                if (N = y.Rn.pop()) {
                    for (K = P(y); 0 < K; K--) e = u(y), N[e] = y.u[e];
                    y.u = (N[236] = y.u[236], N[307] = y.u[307], N)
                } else V(278, y, y.B)
            }), k), function(y, e) {
                (e = v(y, u(y)), Uk)(e, y.C)
            }), function(y, e, K, N) {
                (e = v(y, (N = v((K = (N = u((e = u(y), y)), u(y)), y), N), e)) == N, V)(K, y, +e)
            })), k), function(y) {
                xz(4, y)
            }), function(y, e, K, N, Q, Z) {
                if (!l(y, e, true, true)) {
                    if ("object" == (y = v((N = (Q = v((e = v((N = (e = (Q = (Z = u(y), u)(y), u(y)), u)(y), y), e), y), Q), v(y, N)), y), Z), qX)(y)) {
                        for (K in Z = [], y) Z.push(K);
                        y = Z
                    }
                    for (Z = (e = 0 < e ? e : 1, K = y.length, 0); Z < K; Z += e) Q(y.slice(Z, (Z | 0) + (e | 0)), N)
                }
            })), p(193, k, function(y, e, K, N, Q) {
                0 !== (Q = v(y, (K = (e = v((N = v(y, (N = (Q = u((K = u(y), y)), e = u(y), u(y)), N)), y), e), v(y.C, K)), Q)), K) && (N = Ba(e, N, y, 1, K, Q), K.addEventListener(Q, N, W), V(270, y, [K, Q, N]))
            }), 687)), k), function(y) {
                sk(y, 4)
            }), k), 0), k), function() {}), function(y, e, K, N, Q, Z, w) {
                for (w = (e = (K = (N = u(y), Z = eM(y), Q = "", v(y, 115)), K.length), 0); Z--;) w = ((w | 0) + (eM(y) | 0)) % e, Q += q[K[w]];
                V(N, y, Q)
            })), function(y, e, K) {
                K = v((e = (K = (e = u(y), u(y)), 0 != v(y, e)), y), K), e && V(278, y, K)
            })), function(y, e, K, N, Q) {
                for (K = (e = (N = u(y), eM)(y), 0), Q = []; K < e; K++) Q.push(P(y));
                V(N, y, Q)
            })), function(y, e, K) {
                (e = u((K = u(y), y)), V)(e, y, "" + v(y, K))
            })), V)(408, k, [0, 0, 0]), [])), function(y, e, K, N, Q, Z, w, U, h, T, Y, J) {
                function f(b, a) {
                    for (; e < b;) T |= P(y) << e, e += 8;
                    return T >>= (a = T & (e -= b, (1 << b) - 1), b), a
                }
                for (K = (h = (U = (Y = (e = T = (Z = u(y), 0), f(3) | 0) + 1, f(5)), 0), []), Q = 0; Q < U; Q++) J = f(1), K.push(J), h += J ? 0 : 1;
                for (Q = (N = (h = ((h | 0) - 1).toString(2).length, []), 0); Q < U; Q++) K[Q] || (N[Q] = f(h));
                for (h = 0; h < U; h++) K[h] && (N[h] = u(y));
                for (w = []; Y--;) w.push(v(y, u(y)));
                p(Z, y, function(b, a, O, VB, X) {
                    for (O = (VB = (X = [], []), 0); O < U; O++) {
                        if (a = N[O], !K[O]) {
                            for (; a >= X.length;) X.push(u(b));
                            a = X[a]
                        }
                        VB.push(a)
                    }
                    b.L = h8(b, w.slice()), b.N = h8(b, VB)
                })
            })), k), {}), k), function(y) {
                al(y, 1)
            }), function(y, e, K) {
                l(y, e, true, false) || (e = u(y), K = u(y), V(K, y, function(N) {
                    return eval(N)
                }(Gu(v(y.C, e)))))
            })), 499), k, function(y) {
                sk(y, 3)
            }), 0), k), function(y, e, K, N) {
                K = (N = P((e = u(y), y)), u(y)), V(K, y, v(y, e) >>> N)
            }), 0), function(y, e, K, N) {
                V((e = v(y, (N = v(y, (K = u((N = u(y), y)), N)), K)), K), y, e + N)
            })), function(y, e) {
                y = (e = u(y), v)(y.C, e), y[0].removeEventListener(y[1], y[2], W)
            })), k), function(y, e, K, N, Q) {
                V((K = v(y, (N = (Q = v(y, (Q = (N = (K = (e = u(y), u(y)), u(y)), u)(y), Q)), v(y, N)), K)), e), y, Ba(K, N, y, Q))
            }), k), function(y, e, K) {
                V((K = v(y, (e = (K = u(y), u(y)), K)), K = qX(K), e), y, K)
            }), 0)), S(4))), k), function(y, e, K, N, Q, Z) {
                l(y, e, true, false) || (N = re(y.C), e = N.o, Z = N.Ck, Q = N.h, K = e.length, N = N.un, e = 0 == K ? new Z[Q] : 1 == K ? new Z[Q](e[0]) : 2 == K ? new Z[Q](e[0], e[1]) : 3 == K ? new Z[Q](e[0], e[1], e[2]) : 4 == K ? new Z[Q](e[0], e[1], e[2], e[3]) : 2(), V(N, y, e))
            }), function(y, e, K, N) {
                N = u((e = u(y), y)), K = u(y), y.C == y && (N = v(y, N), K = v(y, K), v(y, e)[N] = K, 358 == e && (y.A = void 0, 2 == N && (y.O = L(32, y, false), y.A = void 0)))
            })), function(y) {
                al(y, 4)
            })), [])), k), H), k), 2048), k).an = 0, 0), 0]), 120), k, k), k), function(y, e, K, N) {
                V((K = v((e = v(y, (N = u((K = u((e = u(y), y)), y)), e)), y), K), N), y, e[K])
            }), p(472, k, function(y, e, K, N) {
                N = (e = u(y), u)(y), K = u(y), V(K, y, v(y, e) || v(y, N))
            }), [Rl])), [A, n])), k), [Il, R]), true), k, true)
        },
        J8 = function(R, n) {
            return d[R](d.prototype, {
                pop: n,
                replace: n,
                length: n,
                document: n,
                splice: n,
                parent: n,
                stack: n,
                floor: n,
                prototype: n,
                console: n,
                call: n,
                propertyIsEnumerable: n
            })
        },
        pX = function(R, n, k, q, c) {
            for (q = (R = R.replace(/\r\n/g, "\n"), n = 0, []), k = 0; n < R.length; n++) c = R.charCodeAt(n), 128 > c ? q[k++] = c : (2048 > c ? q[k++] = c >> 6 | 192 : (55296 == (c & 64512) && n + 1 < R.length && 56320 == (R.charCodeAt(n + 1) & 64512) ? (c = 65536 + ((c & 1023) << 10) + (R.charCodeAt(++n) & 1023), q[k++] = c >> 18 | 240, q[k++] = c >> 12 & 63 | 128) : q[k++] = c >> 12 | 224, q[k++] = c >> 6 & 63 | 128), q[k++] = c & 63 | 128);
            return q
        },
        LX = function(R, n, k, q, c, y) {
            if (!n.R) {
                n.J++;
                try {
                    for (k = (q = (y = void 0, n).B, 0); --R;) try {
                        if ((c = void 0, n).L) y = Zn(n, n.L);
                        else {
                            if (k = v(n, 278), k >= q) break;
                            y = (c = (V(426, n, k), u(n)), v)(n, c)
                        }(y && y[ue] & 2048 ? y(n, R) : M(n, 0, [x, 21, c]), l)(n, R, false, false)
                    } catch (e) {
                        v(n, 409) ? M(n, 22, e) : V(409, n, e)
                    }
                    if (!R) {
                        if (n.Lk) {
                            n.J--, LX(338687074593, n);
                            return
                        }
                        M(n, 0, [x, 33])
                    }
                } catch (e) {
                    try {
                        M(n, 22, e)
                    } catch (K) {
                        r(n, K)
                    }
                }
                n.J--
            }
        },
        Zn = function(R, n) {
            return (n = n.create().shift(), R.L.create()).length || R.N.create().length || (R.L = void 0, R.N = void 0), n
        },
        Dn = function(R, n, k, q) {
            function c() {}
            return {
                invoke: (k = QB((q = void 0, R), function(y) {
                    c && (n && z(n), q = y, c(), c = void 0)
                }, !!n)[0], function(y, e, K, N) {
                    function Q() {
                        q(function(Z) {
                            z(function() {
                                y(Z)
                            })
                        }, K)
                    }
                    if (!e) return e = k(K), y && y(e), e;
                    q ? Q() : (N = c, c = function() {
                        N(), z(Q)
                    })
                })
            }
        },
        v = function(R, n) {
            if (void 0 === (R = R.u[n], R)) throw [x, 30, n];
            if (R.value) return R.create();
            return R.create(1 * n * n + 42 * n + -40), R.prototype
        },
        D = function(R, n, k, q) {
            for (k = (q = (R | 0) - 1, []); 0 <= q; q--) k[(R | 0) - 1 - (q | 0)] = n >> 8 * q & 255;
            return k
        },
        Uk = function(R, n) {
            V(278, ((n.Rn.push(n.u.slice()), n.u)[278] = void 0, n), R)
        },
        r = function(R, n) {
            R.R = ((R.R ? R.R + "~" : "E:") + n.message + ":" + n.stack).slice(0, 2048)
        },
        fX = function(R, n, k) {
            return n.W(function(q) {
                k = q
            }, false, R), k
        },
        Ba = function(R, n, k, q, c, y) {
            function e() {
                if (k.C == k) {
                    if (k.u) {
                        var K = [m, R, n, void 0, c, y, arguments];
                        if (2 == q) var N = B(false, (C(k, K), k), false);
                        else if (1 == q) {
                            var Q = !k.P.length;
                            C(k, K), Q && B(false, k, false)
                        } else N = ca(k, K);
                        return N
                    }
                    c && y && c.removeEventListener(y, e, W)
                }
            }
            return e
        },
        S = function(R, n) {
            for (n = []; R--;) n.push(255 * Math.random() | 0);
            return n
        },
        ca = function(R, n, k, q, c) {
            if (c = n[0], c == g) R.g = 25, R.v(n);
            else if (c == F) {
                q = n[1];
                try {
                    k = R.R || R.v(n)
                } catch (y) {
                    r(R, y), k = R.R
                }
                q(k)
            } else if (c == jM) R.v(n);
            else if (c == A) R.v(n);
            else if (c == Il) {
                try {
                    for (k = 0; k < R.j.length; k++) try {
                        q = R.j[k], q[0][q[1]](q[2])
                    } catch (y) {}
                } catch (y) {}(0, n[R.j = [], 1])(function(y, e) {
                    R.W(y, true, e)
                }, function(y) {
                    (C((y = !R.P.length, R), [ue]), y) && B(false, R, true)
                })
            } else {
                if (c == m) return k = n[2], V(126, R, n[6]), V(15, R, k), R.v(n);
                c == ue ? (R.K = [], R.i = [], R.u = null) : c == Rl && "loading" === H.document.readyState && (R.F = function(y, e) {
                    function K() {
                        e || (e = true, y())
                    }
                    H.document.addEventListener("DOMContentLoaded", (e = false, K), W), H.addEventListener("load", K, W)
                })
            }
        },
        al = function(R, n, k, q) {
            G((k = u(R), q = u(R), q), R, D(n, v(R, k)))
        },
        $z = function(R, n) {
            if ((R = null, n = H.trustedTypes, !n) || !n.createPolicy) return R;
            try {
                R = n.createPolicy("bg", {
                    createHTML: zu,
                    createScript: zu,
                    createScriptURL: zu
                })
            } catch (k) {
                H.console && H.console.error(k.message)
            }
            return R
        },
        zu = function(R) {
            return R
        },
        M = function(R, n, k, q, c, y) {
            if (!R.D) {
                if ((k = v(R, (n = (0 == (q = ((c = void 0, k && k[0] === x) && (c = k[2], n = k[1], k = void 0), v)(R, 236), q).length && (y = v(R, 426) >> 3, q.push(n, y >> 8 & 255, y & 255), void 0 != c && q.push(c & 255)), ""), k && (k.message && (n += k.message), k.stack && (n += ":" + k.stack)), 307)), 3) < k) {
                    R.C = (c = (n = pX((k -= ((n = n.slice(0, (k | 0) - 3), n.length) | 0) + 3, n)), R.C), R);
                    try {
                        G(421, R, D(2, n.length).concat(n), 9)
                    } finally {
                        R.C = c
                    }
                }
                V(307, R, k)
            }
        },
        H = this || self,
        t = function(R, n, k) {
            k = this;
            try {
                Tu(n, R, this)
            } catch (q) {
                r(this, q), n(function(c) {
                    c(k.R)
                })
            }
        },
        h8 = function(R, n, k) {
            return k = d[R.I](R.In), k[R.I] = function() {
                return n
            }, k.concat = function(q) {
                n = q
            }, k
        },
        W = {
            passive: true,
            capture: true
        },
        re = function(R, n, k, q, c, y) {
            for (q = (c = (n = (k = u((y = R[le] || {}, R)), y.un = u(R), y.o = [], R.C == R ? (P(R) | 0) - 1 : 1), u(R)), 0); q < n; q++) y.o.push(u(R));
            for (y.Ck = v(R, c); n--;) y.o[n] = v(R, y.o[n]);
            return y.h = v(R, k), y
        },
        z = H.requestIdleCallback ? function(R) {
            requestIdleCallback(function() {
                R()
            }, {
                timeout: 4
            })
        } : H.setImmediate ? function(R) {
            setImmediate(R)
        } : function(R) {
            setTimeout(R, 0)
        },
        de = function(R, n) {
            n.push(R[0] << 24 | R[1] << 16 | R[2] << 8 | R[3]), n.push(R[4] << 24 | R[5] << 16 | R[6] << 8 | R[7]), n.push(R[8] << 24 | R[9] << 16 | R[10] << 8 | R[11])
        },
        le = String.fromCharCode(105, 110, 116, 101, 103, 67, 104, 101, 99, 107, 66, 121, 112, 97, 115, 115),
        x = ((t.prototype.V = "toString", t.prototype.Lk = false, t).prototype.Qy = void 0, {}),
        g = [],
        Il = [],
        jM = [],
        A = [],
        m = [],
        ue = (t.prototype.kh = void 0, []),
        F = [],
        Rl = [],
        d = (E = ((de, function() {})(S), yB, Ek, t.prototype), E.zc = function() {
            return Math.floor(this.G + (this.s() - this.H))
        }, x.constructor),
        va = (E.s = (t.prototype.I = "create", (E.dE = (E.W = function(R, n, k, q, c) {
            if ((k = "array" === qX(k) ? k : [k], this).R) R(this.R);
            else try {
                q = !this.P.length, c = [], C(this, [g, c, k]), C(this, [F, R, c]), n && !q || B(true, this, n)
            } catch (y) {
                r(this, y), R(this.R)
            }
        }, function(R, n, k, q, c, y) {
            for (c = q = 0, y = []; q < R.length; q++)
                for (c += n, k = k << n | R[q]; 7 < c;) c -= 8, y.push(k >> c & 255);
            return y
        }), (E.eN = (E.s9 = function(R, n, k) {
            return ((n = (n ^= n << 13, n ^= n >> 17, (n ^ n << 5) & k)) || (n = 1), R) ^ n
        }, function(R, n, k, q, c) {
            for (q = c = 0; c < R.length; c++) q += R.charCodeAt(c), q += q << 10, q ^= q >> 6;
            return c = new Number((q += q << 3, q ^= q >> 11, R = q + (q << 15) >>> 0, R & (1 << n) - 1)), c[0] = (R >>> n) % k, c
        }), E.FH = function() {
            return Math.floor(this.s())
        }, window.performance || {}).now) ? function() {
            return this.B0 + window.performance.now()
        } : function() {
            return +new Date
        }), void 0),
        CX = ((t.prototype.v = function(R, n) {
            return n = {}, va = (R = {}, function() {
                    return n == R ? -40 : 9
                }),
                function(k, q, c, y, e, K, N, Q, Z, w, U, h, T, Y, J) {
                    n = (Y = n, R);
                    try {
                        if (h = k[0], h == A) {
                            T = k[1];
                            try {
                                for (Q = (y = atob(T), e = [], K = 0); Q < y.length; Q++) J = y.charCodeAt(Q), 255 < J && (e[K++] = J & 255, J >>= 8), e[K++] = J;
                                V(358, this, (this.B = (this.i = e, this.i).length << 3, [0, 0, 0]))
                            } catch (f) {
                                M(this, 17, f);
                                return
                            }
                            LX(8001, this)
                        } else if (h == g) k[1].push(v(this, 307), v(this, 421).length, v(this, 352).length, v(this, 305).length), V(15, this, k[2]), this.u[349] && Pa(this, 8001, v(this, 349));
                        else {
                            if (h == F) {
                                this.C = (Z = (U = D(2, (v(this, (K = k[2], 305)).length | 0) + 2), this.C), this);
                                try {
                                    w = v(this, 236), 0 < w.length && G(305, this, D(2, w.length).concat(w), 10), G(305, this, D(1, this.Y), 109), G(305, this, D(1, this[F].length)), y = 0, y -= (v(this, 305).length | 0) + 5, y += v(this, 289) & 2047, q = v(this, 421), 4 < q.length && (y -= (q.length | 0) + 3), 0 < y && G(305, this, D(2, y).concat(S(y)), 15), 4 < q.length && G(305, this, D(2, q.length).concat(q), 156)
                                } finally {
                                    this.C = Z
                                }
                                if (c = ((Q = S(2).concat(v(this, 305)), Q[1] = Q[0] ^ 6, Q[3] = Q[1] ^ U[0], Q)[4] = Q[1] ^ U[1], this.rE(Q))) c = "!" + c;
                                else
                                    for (c = "", y = 0; y < Q.length; y++) N = Q[y][this.V](16), 1 == N.length && (N = "0" + N), c += N;
                                return v(this, (v((v((V(307, this, (e = c, K.shift())), this), 421).length = K.shift(), this), 352).length = K.shift(), 305)).length = K.shift(), e
                            }
                            if (h == jM) Pa(this, k[2], k[1]);
                            else if (h == m) return Pa(this, 8001, k[1])
                        }
                    } finally {
                        n = Y
                    }
                }
        }(), t.prototype).rE = function(R, n, k, q) {
            if (n = window.btoa) {
                for (q = (k = 0, ""); k < R.length; k += 8192) q += String.fromCharCode.apply(null, R.slice(k, k + 8192));
                R = n(q).replace(/\+/g, "-").replace(/\//g, "_").replace(/=/g, "")
            } else R = void 0;
            return R
        }, /./);
    (t.prototype.Ax = 0, t.prototype).yy = 0;
    var be, Fn = A.pop.bind((t.prototype[Il] = [0, 0, 1, 1, 0, 1, 1], t).prototype[g]),
        Gu = function(R, n) {
            return (n = $z()) && 1 === R.eval(n.createScript("1")) ? function(k) {
                return n.createScript(k)
            } : function(k) {
                return "" + k
            }
        }(((be = J8(t.prototype.I, {get: (CX[t.prototype.V] = Fn, Fn)
        }), t.prototype).O9 = void 0, H));
    40 < (I = H.botguard || (H.botguard = {}), I.m) || (I.m = 41, I.bg = Dn, I.a = QB), I.bDL_ = function(R, n, k) {
        return k = new t(R, n), [function(q) {
            return fX(q, k)
        }]
    };
}).call(this);
#3 JavaScript::Eval (size: 64) - SHA256: cc158dc49db31ac40a09769c14f1e96ce12d8ee44ddb54a5321c32cd0536ef78
0,
function(y, e, K) {
    (e = (K = u((e = u(y), y)), y.u[e] && v(y, e)), V)(K, y, e)
}
#4 JavaScript::Eval (size: 22) - SHA256: 2ed176c7f9d5b3c8ca6ccdb0e994b6ddc34944c41fc4db7451fd7a3d27fed6f1
0,
function(y) {
    xz(2, y)
}
#5 JavaScript::Eval (size: 22) - SHA256: 9bb0c662c12831d4a6a9d504b2534e28f08b91591da1303a05ad2b3e12a6e49e
0,
function(y) {
    xz(1, y)
}

Executed Writes (2)
#1 JavaScript::Write (size: 178) - SHA256: 854fe45fbedc9cb4a9b0def7bec122dd2d5d997f82d2cac592645667cad8c929
<!-- Segment Pixel - 20bet Homepage - DO NOT MODIFY --> <script src="https://secure.adnxs.com/seg?add=30613014&t=1" type="text/javascript"></script> <!-- End of Segment Pixel -->
#2 JavaScript::Write (size: 190) - SHA256: 743f6492a5beb847167322304f93922a25b48b4fda556b6039418e53930e9df1
<!-- AppNexus Sync pixel START--><img src="https://secure.adnxs.com/getuidnb?https%3A//zz.connextra.com/sync/data/uid/3bc1d7fd2e/%24UID" width="1" height="1"/><!--AppNexus Sync pixel: END-->


HTTP Transactions (417)


Request Response
                                        
                                            GET / HTTP/1.1 
Host: aze.bkin-8443.space
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: keep-alive
Upgrade-Insecure-Requests: 1

search
                                         172.67.188.40
HTTP/1.1 301 Moved Permanently
                                        
Date: Sat, 26 Nov 2022 15:48:47 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Cache-Control: max-age=3600
Expires: Sat, 26 Nov 2022 16:48:47 GMT
Location: https://aze.bkin-8443.space/
Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yJFTJpr168KSfDN%2BLmorUbvKKVwpY%2BdZp6HggT%2B91DamZr%2F8D%2BFuIWv9j2XSaJKyuOUIoLE6GmysAu6vwlzrAxHOAdBIuDXwPeQ5f33FyIabn%2F8ALb5FrGNp%2B%2BgAjlpMZuGvWsjD"}],"group":"cf-nel","max_age":604800}
NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7703c53589e71c06-OSL
alt-svc: h2=":443"; ma=60


--- Additional Info ---
Magic:  
Size:   0
Md5:    d41d8cd98f00b204e9800998ecf8427e
Sha1:   da39a3ee5e6b4b0d3255bfef95601890afd80709
Sha256: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "164D11173045B569CAFB32E300E4C1EC6D6AB177FD34D0414CC40C541268779F"
Last-Modified: Thu, 24 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=4711
Expires: Sat, 26 Nov 2022 17:07:18 GMT
Date: Sat, 26 Nov 2022 15:48:47 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "5EA71CE6DD9E927F9BB3F97F59CC1AC7DC25A949024815965B29BC5835614786"
Last-Modified: Sat, 26 Nov 2022 09:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=14708
Expires: Sat, 26 Nov 2022 19:53:55 GMT
Date: Sat, 26 Nov 2022 15:48:47 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3636
Cache-Control: max-age=157377
Date: Sat, 26 Nov 2022 15:48:47 GMT
Etag: "6381eaec-1d7"
Expires: Mon, 28 Nov 2022 11:31:44 GMT
Last-Modified: Sat, 26 Nov 2022 10:31:08 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /chains/remote-settings.content-signature.mozilla.org-2022-12-30-09-21-26.chain HTTP/1.1 
Host: content-signature-2.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site

search
                                         34.160.144.191
HTTP/2 200 OK
content-type: binary/octet-stream
                                        
x-amz-id-2: YCFzlBdPi2tzWkDcl/iDjiXxU+0KlNVShGa2L6/Mc7mYNhTjHb7SaLwRC7idHe82sIW7keLlb9w=
x-amz-request-id: H2AD2N7Q4R1MSE4G
content-disposition: attachment
accept-ranges: bytes
server: AmazonS3
content-length: 5348
via: 1.1 google
date: Sat, 26 Nov 2022 15:44:17 GMT
age: 270
last-modified: Thu, 10 Nov 2022 09:21:27 GMT
etag: "9ebddc2b260d081ebbefee47c037cb28"
cache-control: public,max-age=3600
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PEM certificate\012- , ASCII text
Size:   5348
Md5:    9ebddc2b260d081ebbefee47c037cb28
Sha1:   492bad62a7ca6a74738921ef5ae6f0be5edebf39
Sha256: 74bbb7cba16f7d084a08a0907d47d7496e5c148f904707ec6950f8f6a61027e5
                                        
                                            GET /v1/ HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: Content-Type, Retry-After, Content-Length, Alert, Backoff
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 939
via: 1.1 google
date: Sat, 26 Nov 2022 15:19:13 GMT
cache-control: public,max-age=3600
age: 1774
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (939), with no line terminators
Size:   939
Md5:    567df7db606cf5d0871aa5bc9311b6da
Sha1:   4263faac7cbab2fcaf6661911dcad5091c06be17
Sha256: e9650e1fdc46fc8678708ddcc37ab369c7a6d50489a004be896f20c7a3a644b0
                                        
                                            GET /v1/tiles HTTP/1.1 
Host: contile.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.117.237.239
HTTP/2 200 OK
content-type: application/json
                                        
server: nginx
date: Sat, 26 Nov 2022 15:48:47 GMT
content-length: 12
strict-transport-security: max-age=31536000
via: 1.1 google
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   12
Md5:    23e88fb7b99543fb33315b29b1fad9d6
Sha1:   a48926c4ec03c7c8a4e8dffcd31e5a6cdda417ce
Sha256: 7d8f1de8b7de7bc21dfb546a1d0c51bf31f16eee5fad49dbceae1e76da38e5c3
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Cache-Control: max-age=147985
Date: Sat, 26 Nov 2022 15:48:47 GMT
Etag: "6381d470-117"
Expires: Mon, 28 Nov 2022 08:55:12 GMT
Last-Modified: Sat, 26 Nov 2022 08:55:12 GMT
Server: nginx
Content-Length: 279

                                        
                                            GET /v1/buckets/main/collections/ms-language-packs/records/cfr-v1-en-US HTTP/1.1 
Host: firefox.settings.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.102.187.140
HTTP/2 200 OK
content-type: application/json
                                        
access-control-allow-origin: *
access-control-expose-headers: ETag, Content-Type, Content-Length, Last-Modified, Alert, Backoff, Pragma, Expires, Retry-After, Cache-Control
content-security-policy: default-src 'none'; frame-ancestors 'none'; base-uri 'none';
strict-transport-security: max-age=31536000
x-content-type-options: nosniff
content-length: 329
via: 1.1 google
date: Sat, 26 Nov 2022 15:11:12 GMT
cache-control: public,max-age=3600
age: 2256
last-modified: Fri, 25 Mar 2022 17:45:46 GMT
etag: "1648230346554"
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (329), with no line terminators
Size:   329
Md5:    0333b0655111aa68de771adfcc4db243
Sha1:   63f295a144ac87a7c8e23417626724eeca68a7eb
Sha256: 60636eb1dc67c9ed000fe0b49f03777ad6f549cb1d2b9ff010cf198465ae6300
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Cache-Control: 'max-age=158059'
Date: Sat, 26 Nov 2022 15:48:48 GMT
Server: ECS (amb/6BBB)
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3638
Cache-Control: 'max-age=158059'
Date: Sat, 26 Nov 2022 15:48:48 GMT
Last-Modified: Sat, 26 Nov 2022 14:48:10 GMT
Server: ECS (ska/F70E)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET / HTTP/1.1 
Host: push.services.mozilla.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: wss://push.services.mozilla.com/
Sec-WebSocket-Protocol: push-notification
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: 39Y+0a0dwZrUagpkgUFfLg==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket

search
                                         44.238.202.79
HTTP/1.1 101 Switching Protocols
                                        
Connection: Upgrade
Upgrade: websocket
Sec-WebSocket-Accept: IxeK/djDHl5Jkoms4PODvJVU7LE=

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7525
Expires: Sat, 26 Nov 2022 17:54:14 GMT
Date: Sat, 26 Nov 2022 15:48:49 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7525
Expires: Sat, 26 Nov 2022 17:54:14 GMT
Date: Sat, 26 Nov 2022 15:48:49 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7525
Expires: Sat, 26 Nov 2022 17:54:14 GMT
Date: Sat, 26 Nov 2022 15:48:49 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7525
Expires: Sat, 26 Nov 2022 17:54:14 GMT
Date: Sat, 26 Nov 2022 15:48:49 GMT
Connection: keep-alive

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "0E943AACB4A46480AB031EF294A0E089976EC125C331C15116B6C79F6B0F2FF0"
Last-Modified: Sat, 26 Nov 2022 04:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=7525
Expires: Sat, 26 Nov 2022 17:54:14 GMT
Date: Sat, 26 Nov 2022 15:48:49 GMT
Connection: keep-alive

                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F8f5318cc-4728-4160-afd1-9d20b79b7de9.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9914
x-amzn-requestid: 4db4ed29-20b4-4ca7-8835-2463d0989d5b
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLVVFHQYIAMFc4Q=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638135b9-613da006118724124e345b29;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:01 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: qKxrYxVsJWOXAbrn6IpwLycF3rknFLkQeDyKOLq5WyflvTLeUjg_Lg==
via: 1.1 41e349e25dc4bc856d0e5d2c162428a0.cloudfront.net (CloudFront), 1.1 e66162aafd55b64ba1478ff7105150fa.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 22:18:42 GMT
age: 63007
etag: "47fac81a2dd809df5c42ca1362f71d553572d2b1"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9914
Md5:    3b1c6878914466cfece680fa7cb73502
Sha1:   47fac81a2dd809df5c42ca1362f71d553572d2b1
Sha256: 6458883dfa2bdfd483e92e5f847a229508ef00ce1dbd11f49eec369d0bd3160a
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fc537c2d0-d011-4ed0-a5d4-5f5d2190c49b.webp HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4366
x-amzn-requestid: ce25f5ab-0c92-431e-ae4e-618829594a74
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLVNZFjHoAMFXLg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-63813588-6a3a8dff70e717011e3a0606;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:37:12 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: CkXSlYXZ0DFVjVSVin4Km3_9nETFtQ8Qf6f2V5kjuwoCejVH3Qk0Qg==
via: 1.1 8f22423015641505b8c857a37450d6c0.cloudfront.net (CloudFront), 1.1 9046e5a276a05e60ee34c8475e92b8e6.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:47:48 GMT
age: 64861
etag: "8665e5f3026f2c2b9505eb139c478f4d359851c3"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4366
Md5:    abd79421a3c44a8df11ad2cc50083309
Sha1:   8665e5f3026f2c2b9505eb139c478f4d359851c3
Sha256: 3a66b00498fa1322730705b1c4502614b5a520ac3f884f494d65e27a5bb62c3f
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1dd98515-d0af-440a-8f3d-4c9986928081.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 4309
x-amzn-requestid: a22b4d7e-e208-4bda-81c2-d13e6463380e
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: blE0hGNioAMF_Tg=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6371e81c-1b13846866f56a0e47675e56;Sampled=0
x-amzn-remapped-date: Mon, 14 Nov 2022 07:02:52 GMT
x-amz-cf-pop: SEA73-P1
x-cache: Hit from cloudfront
x-amz-cf-id: 0sYKpJWi2Tv9Atz3PYXm5j7kmncAOxjcLcK4hgAkJ5b4pNMDmjdB6g==
via: 1.1 ddd913fbbe7367d44af4ac06097e7a2a.cloudfront.net (CloudFront), 1.1 28390a4d24ed4fdccd685d99cd06cf4e.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 02:19:43 GMT
age: 48546
etag: "126771b86638108050cf57c0d12faa27f80f0edb"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   4309
Md5:    841a4b110022a99ddea6f7bf66df0fa1
Sha1:   126771b86638108050cf57c0d12faa27f80f0edb
Sha256: 240fbffc1f9104433297d3ff7afba2d0b58d7f1b13d9a9260a1bad25216665db
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F1de44df6-bdc7-487f-a2a0-b42d26be2420.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 15818
x-amzn-requestid: a6570859-3b03-492e-9f84-e25b01223da2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLXrUF3bIAMF8CA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-6381397b-379b1bcf2ac0715835e10e48;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:54:03 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Hit from cloudfront
x-amz-cf-id: TI0cacek54dPUYW7fYy0xm-1CKdRXZGqBH1vGURakUsBbm-WGcW-vA==
via: 1.1 28a7186077f9b5270d98dd053f31303e.cloudfront.net (CloudFront), 1.1 559326ad73233233a9e52cb9e8601ede.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 22:17:55 GMT
age: 63054
etag: "1ac7a410cd4f3709f476c776dd5646dd982dcfa8"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   15818
Md5:    17ebe470d040a6ea8c57e9b9d4f4e828
Sha1:   1ac7a410cd4f3709f476c776dd5646dd982dcfa8
Sha256: d65114b68fcc12344c6df7bf294718b79822fa9782d3bd54ca044b66f82052b1
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2F34ec689c-96b7-450b-b77e-e0ecb4d89c3c.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 9049
x-amzn-requestid: 6cbd9639-c29d-4ff4-8091-3168f64f4c78
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cLVVGHzKoAMFSuA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-638135ba-100ea4235fdf1df8491041c8;Sampled=0
x-amzn-remapped-date: Fri, 25 Nov 2022 21:38:02 GMT
x-amz-cf-pop: HIO50-C1, SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: utbUF-6Z7rMqPNdRKHJyI-IZoyTy6HpkNBY-60xcZ-6NDXBz1XN6-Q==
via: 1.1 4f87745990545c1ac0195c157e1668f8.cloudfront.net (CloudFront), 1.1 112d82578d402a38d8d02e8b857617e0.cloudfront.net (CloudFront), 1.1 google
date: Fri, 25 Nov 2022 21:48:40 GMT
age: 64809
etag: "3d32bff85cb7ec118c4496d0c3802829fdc9af3b"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   9049
Md5:    c8dc4b8a7e9f7f4f84f0da568b43392b
Sha1:   3d32bff85cb7ec118c4496d0c3802829fdc9af3b
Sha256: 4b0ffde427085c796a7a5823604b29a4af43dbb93e99ec41f34feb37f52ac7d9
                                        
                                            GET /296x148/filters:format(jpeg):quality(60):no_upscale():strip_exif()/https%3A%2F%2Fs3.amazonaws.com%2Fpocket-curatedcorpusapi-prod-images%2Fcf04cc9f-ee4b-42fd-914f-cd86b9dc30eb.jpeg HTTP/1.1 
Host: img-getpocket.cdn.mozilla.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: null
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site

search
                                         34.120.237.76
HTTP/2 200 OK
content-type: image/jpeg
                                        
server: nginx
content-length: 3502
x-amzn-requestid: ca3f2610-e03c-48a7-abb3-fbbab76f63d2
x-xss-protection: 1; mode=block
access-control-allow-origin: *
strict-transport-security: max-age=63072000; includeSubdomains; preload
x-frame-options: DENY
content-security-policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; object-src 'none'
x-amz-apigw-id: cCvYUHO5IAMFqDA=
x-content-type-options: nosniff
x-amzn-trace-id: Root=1-637dc5ce-7e36137711dc4668278c1c94;Sampled=0
x-amzn-remapped-date: Wed, 23 Nov 2022 07:03:42 GMT
x-amz-cf-pop: SEA19-C2
x-cache: Miss from cloudfront
x-amz-cf-id: SRN-oOfa8Z0mQZFYkWAv32XFiXChfGjfwZkfWz-IzHubwrKgzwoTxQ==
via: 1.1 8dbfaf7df256a75768461d934659b6b2.cloudfront.net (CloudFront), 1.1 aef00f14752da9aa504d392fd46eff94.cloudfront.net (CloudFront), 1.1 google
date: Sat, 26 Nov 2022 03:55:38 GMT
age: 42791
etag: "61f9bed607e81606be78285596acdc5e0e4f4994"
cache-control: max-age=3600,public,public
alt-svc: clear
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 296x148, components 3\012- data
Size:   3502
Md5:    a783df85f30f9c555f9df6b99f61744d
Sha1:   61f9bed607e81606be78285596acdc5e0e4f4994
Sha256: 19db42201d0fa059f680d890ede6683c04e893e6308a2256d0203f826a7f34de
                                        
                                            GET / HTTP/1.1 
Host: aze.bkin-8443.space
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Cookie: antibot_uid=68a14cf1cee0b945c3a456a5ca39075c; antibot_country=NO; antibot_lang=en; antibot_ptr=s919042154.blix.com; antibot_c83b08b5cbd430a2d1e45b7387b8a9ce=7210524dbe6e19a09fa9bacd3c7ecee0; lastcid=1669477728.0559
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.21.81.37
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:49 GMT
location: https://promo.20bet.partners/redirect.aspx?pid=11600&bid=1971&lpid=281
set-cookie: antibot_hits=2; expires=Sun, 27-Nov-2022 15:48:49 GMT; Max-Age=86400; path=/ antibot_unique_20221126=1; expires=Sun, 27-Nov-2022 15:48:49 GMT; Max-Age=86400; path=/ lastcid=0; expires=Sat, 26-Nov-2022 15:47:09 GMT; Max-Age=0; path=/ 6ab198438682a4d098bc4c6778fef98d=0; expires=Sat, 26-Nov-2022 16:48:49 GMT; Max-Age=3600; path=/
expires: Tue, 06 Dec 2022 15:48:49 GMT
last-modified: Sat, 26 Nov 2022 15:48:49 GMT
cache-control: public, max-age=864000
vary: Accept-Encoding
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=91fksvDqdaeUmBD1td4Jy5cKmVRvafz%2FM5owZcdA38xkhmZWRg%2FP8hYpNJ%2F21cj0oiyqcrZ3rZt3usd6fashc4MD5Uy0Q00mDtALdQ7lixeSygfZqkKtvaZbQRnjEvcFEUW8btNY"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7703c54029590af6-OSL
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (3964)
Size:   12202
Md5:    db807cb472143ad3110b46db919a3d3c
Sha1:   8bd2f9bea7c914119cf889b197038d01783c2181
Sha256: b3d16a1bf1166144c97423d5ba15f926dbcf2b1916f9b7e311e5cb1300d6d5e2

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 58
Cache-Control: max-age=102303
Date: Sat, 26 Nov 2022 15:48:50 GMT
Etag: "638121c7-1d7"
Expires: Sun, 27 Nov 2022 20:13:53 GMT
Last-Modified: Fri, 25 Nov 2022 20:12:55 GMT
Server: ECS (amb/6B9A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562 HTTP/1.1 
Host: 20media.world
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.26.3.3
HTTP/2 302 Found
content-type: text/html; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:50 GMT
location: https://app.adjust.com/js8txs6?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562&label=656524_3D81B86A9C4B4E02ACF86B3E8624D562&redirect=https%3A%2F%2F20bet.com%2Fcasino%3Fbtag%3D656524_3D81B86A9C4B4E02ACF86B3E8624D562
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
report-to: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uwtCAsqGjhCw1%2BSLMRQ%2BrX8TIXuQ0v0buux6EX%2BzEhFxnZkjzaAm6NqtIkFzajtEv5SsqPiMC%2BCwyxCU1LWfbvym6u%2Buo7alxhrdUDV38BH1g9Ksx9U%2Fz%2FRuF1IrFPU%3D"}],"group":"cf-nel","max_age":604800}
nel: {"success_fraction":0,"report_to":"cf-nel","max_age":604800}
server: cloudflare
cf-ray: 7703c547cf06b518-OSL
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document, ASCII text
Size:   92
Md5:    9285572306c6c5c79dabc845039780db
Sha1:   12856131f171a5140e3957e49ec93beab40a0dad
Sha256: 18e1324f8accdc40e815fed13145ac253f2dbaac0e3270f5a3b083ef4fccc832
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4534
Cache-Control: max-age=116886
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "63814943-117"
Expires: Mon, 28 Nov 2022 00:16:57 GMT
Last-Modified: Fri, 25 Nov 2022 23:01:23 GMT
Server: ECS (ska/F715)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1502
Cache-Control: max-age=141531
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "6381b560-118"
Expires: Mon, 28 Nov 2022 07:07:42 GMT
Last-Modified: Sat, 26 Nov 2022 06:42:40 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 280

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4555
Cache-Control: max-age=98909
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "638102f6-116"
Expires: Sun, 27 Nov 2022 19:17:20 GMT
Last-Modified: Fri, 25 Nov 2022 18:01:26 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 278

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1437
Cache-Control: max-age=145823
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "6381c665-117"
Expires: Mon, 28 Nov 2022 08:19:14 GMT
Last-Modified: Sat, 26 Nov 2022 07:55:17 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 1437
Cache-Control: max-age=145823
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "6381c665-117"
Expires: Mon, 28 Nov 2022 08:19:14 GMT
Last-Modified: Sat, 26 Nov 2022 07:55:17 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 279

                                        
                                            GET /sdks/OneSignalSDK.js HTTP/1.1 
Host: cdn.onesignal.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.226.52
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Sat, 26 Nov 2022 15:48:51 GMT
etag: W/"ae63ef8ff03da61fffaa7f165729897a"
via: 1.1 google
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400
cf-cache-status: HIT
age: 2216
expires: Tue, 29 Nov 2022 15:48:51 GMT
cache-control: public, max-age=259200
vary: Accept-Encoding
strict-transport-security: max-age=15552000; includeSubDomains
server: cloudflare
cf-ray: 7703c54e3cfeb517-OSL
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (9097)
Size:   3338
Md5:    d17d5d4acbfb75d699023b3eb07cc201
Sha1:   ef821569583e5437da093629b6cd0646c05bb9a4
Sha256: 1d36e476e096439e83f807149a0a0a21aa07b7ebe949a84fc1c50c5dea4ba142
                                        
                                            GET /assets/loader.gif HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: image/gif
                                        
date: Sat, 26 Nov 2022 15:48:51 GMT
content-length: 402680
cf-ray: 7703c54ddae3991b-ARN
accept-ranges: bytes
etag: "637def34-624f8"
last-modified: Wed, 23 Nov 2022 10:00:20 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 400 x 400\012- data
Size:   402680
Md5:    8529d23ed344b353f7b89b4c90b1aa82
Sha1:   5433dc4344e9fc4f3b516febe6c9df5e9fec1657
Sha256: d8a42ccb018c64bda5b2cac2f522c7895ce66055455e9eb9a0425dd7cfe18771
                                        
                                            GET /sealassets/73fefd2c6cf1ebaa3fecd8616910c51d-20bet.com-f5faf6d82a7be2057527120fa49724355adf2a8c973918d432fa7b70160234e717ac6b01358f27fc0aff52358b79fb11-c3BhY2VyLXNwcml0ZS5wbmc%3D HTTP/1.1 
Host: c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         54.230.111.125
HTTP/2 200 OK
content-type: image/png
                                        
content-length: 95
date: Sat, 26 Nov 2022 15:45:13 GMT
x-powered-by: Express
cache-control: max-age=1200
etag: W/"5f-NEKpX+iQzkdps2suzGEbgBpUz7U"
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703bffa9a315c92-FRA
x-cache: Hit from cloudfront
via: 1.1 e2f427863e6bdb72ad8bed72b596d81e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: C7p0-KRjpAJSqpqpGTX-Zu7OjwuWEbDxQKdwHsK4vMcjXhA3d2gXnw==
age: 218
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 1 x 1, 1-bit colormap, non-interlaced\012- data
Size:   95
Md5:    9591c410148e6883727c5339fd1c02cd
Sha1:   3442a95fe890ce4769b36b2ecc611b801a54cfb5
Sha256: cafbd551d674da240212f6c44988757a728b9dc8cbc2a6c8dcf53c0d9159c323

Alerts:
  Blocklists:
    - fortinet: Malware
                                        
                                            GET /sealassets/73fefd2c6cf1ebaa3fecd8616910c51d-20bet.com-f5faf6d82a7be2057527120fa49724355adf2a8c973918d432fa7b70160234e717ac6b01358f27fc0aff52358b79fb11-c3ByaXRlLXNlYWwucG5n?status=valid HTTP/1.1 
Host: c4457c89-e5ba-4d22-92e5-c2959310ee85.snippet.antillephone.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         54.230.111.125
HTTP/2 200 OK
content-type: image/png
                                        
content-length: 49397
date: Sat, 26 Nov 2022 15:45:13 GMT
x-powered-by: Express
cache-control: max-age=1200
etag: W/"c0f5-y5nfd/SGXZwvKHU5pcpHTPdvfQk"
strict-transport-security: max-age=15724800; includeSubDomains
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703bffaafd79969-FRA
x-cache: Hit from cloudfront
via: 1.1 e2f427863e6bdb72ad8bed72b596d81e.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: vGjuH8ZJHLzrB84_bsCZ0AwKAWN16GD9uYFcmrFmJn52Vv7nKK4_Tw==
age: 218
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 512 x 256, 8-bit/color RGBA, non-interlaced\012- data
Size:   49397
Md5:    8ef6782be55b8ce8f5b132d28af8e0d0
Sha1:   cb99df77f4865d9c2f287539a5ca474cf76f7d09
Sha256: d614922fde9604f8899e47f3cc3d69bf952312b996f7cf1421163996710850fa
                                        
                                            GET /dist/tag-manager.js?id=STM-AAAACT HTTP/1.1 
Host: tm.ads.sportradar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.79.43
HTTP/2 200 OK
content-type: application/javascript
                                        
apigw-requestid: cNyMRjD6joEEP5g=
vary: Accept-Encoding
content-encoding: gzip
content-length: 31257
date: Sat, 26 Nov 2022 15:48:51 GMT
cache-control: max-age=900, public
x-n: S
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 text, with very long lines (65535), with no line terminators
Size:   31257
Md5:    c107cbeae2be0d4f1d241b9fd672457d
Sha1:   a017d05ff36c646bfa755b60c25e0f67f723de6d
Sha256: 3aac2aa9d355d442078788e431cc0f96baa3f893389c422659323d7602c0261d
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 6242
Cache-Control: max-age=143058
Date: Sat, 26 Nov 2022 15:48:51 GMT
Etag: "6381a8d3-1d7"
Expires: Mon, 28 Nov 2022 07:33:09 GMT
Last-Modified: Sat, 26 Nov 2022 05:49:07 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /gtm.js?id=GTM-55HKBB7 HTTP/1.1 
Host: www.googletagmanager.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.168
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-headers: Cache-Control
content-encoding: br
vary: Accept-Encoding
date: Sat, 26 Nov 2022 15:48:51 GMT
expires: Sat, 26 Nov 2022 15:48:51 GMT
cache-control: private, max-age=900
last-modified: Sat, 26 Nov 2022 15:00:00 GMT
strict-transport-security: max-age=31536000; includeSubDomains
cross-origin-resource-policy: cross-origin
server: Google Tag Manager
content-length: 58807
x-xss-protection: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (23167)
Size:   58807
Md5:    24739b22cf64661796a8bd20d8990e35
Sha1:   c4f88db657985d9548b701196156c3b105e857fc
Sha256: 3786299d1818d32dceb5d89458a594e663a530f4df83f92a72d646359e91f297
                                        
                                            GET /notify/v1/ua-sdk.min.js HTTP/1.1 
Host: aswpsdkus.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         34.160.158.95
HTTP/2 200 OK
content-type: application/javascript
                                        
x-guploader-uploadid: ADPycdtE88BJL2hoYDO-9WdcQaPsd8aFZxw61H1VPh2dSzdFugir-kBfbrH6VqZrFoiqTP6jQncoA6ouY6cgFg3qWNUQ0Q
x-goog-generation: 1665770460678651
x-goog-metageneration: 1
x-goog-stored-content-encoding: gzip
x-goog-stored-content-length: 42633
content-encoding: gzip
x-goog-hash: crc32c=2hVL0A==, md5=iv9O9Jdsw6vOvyD0hXd1Ow==
x-goog-storage-class: MULTI_REGIONAL
accept-ranges: bytes
content-length: 42633
server: UploadServer
date: Sat, 26 Nov 2022 15:48:18 GMT
expires: Sat, 26 Nov 2022 15:53:18 GMT
cache-control: public,max-age=300,no-transform
age: 33
last-modified: Fri, 14 Oct 2022 18:01:00 GMT
etag: "8aff4ef4976cc3abcebf20f48577753b"
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   42633
Md5:    8aff4ef4976cc3abcebf20f48577753b
Sha1:   8dc504909cc95b490c33f80853cc871e4303addd
Sha256: 3f1e34da0d341f968e5e49a8bd25ca2fcb608eb2817998731c6b054113067ee3
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:51 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /7693683943e78a298c36d469e68b47d8/widgetloader HTTP/1.1 
Host: ws-cdn001.akamaized.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.10
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
content-security-policy: frame-ancestors 'self' https://st-cdn001.akamaized.net https://ls-cdn001.akamaized.net
cache-control: public, max-age=120, stale-while-revalidate=60, immutable
etag: "db0186d865fc9184b2dbca94929e9a70-d10d2832f22cfaf198f8475aa5da87da"
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
x-ing-v: 2
content-length: 59676
date: Sat, 26 Nov 2022 15:48:51 GMT
vary: Accept-Encoding
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (40784)
Size:   59676
Md5:    e6a758f4fea764727cde71ec696b971b
Sha1:   8da0ea04742bc06c147e7968b8022c9f7984134d
Sha256: 1fa5d70a768689f32498ffe50c76d71ab6560fcc7313775e9dcb95935c5957fe
                                        
                                            GET /dist/tracker.js HTTP/1.1 
Host: tracker.ads.sportradar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         23.36.79.43
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 20 Jan 2021 14:51:32 GMT
accept-ranges: bytes
server: AmazonS3
etag: "5ff82a1c468a89919e9437d33e0402cb"
x-amz-cf-pop: ARN56-P1
x-amz-cf-id: W_J6AF2Ok-eE3rbP4xPikMa75J_77BR-7Gsxn6KRO6zjS2RaYiGj_Q==
vary: Accept-Encoding
content-encoding: gzip
content-length: 11553
date: Sat, 26 Nov 2022 15:48:51 GMT
cache-control: max-age=900, public
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   13312
Md5:    a25745cfaba2e629cfc3e33ed557dd1b
Sha1:   648102b82b05a9ebf2de49e91991504e6bfe7105
Sha256: 5b3d03b9f4679a1628c81370216246d74a6cfe75af904343320334ff62b05a47
                                        
                                            GET /dist//sp-2.14.0.js HTTP/1.1 
Host: tracker.ads.sportradar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         23.36.79.43
HTTP/2 200 OK
content-type: application/javascript
                                        
last-modified: Wed, 20 Jan 2021 14:51:32 GMT
etag: "8dba669b94e3865c9205ef8fd15ee4d1"
accept-ranges: bytes
server: AmazonS3
x-amz-cf-pop: AMS50-C1
x-amz-cf-id: nhilYV6V-q1PhJgn8gs9dmUPL39Zd2IwgnsFUnicuqpA-U_Vrqb7CA==
vary: Accept-Encoding
content-encoding: gzip
content-length: 30370
date: Sat, 26 Nov 2022 15:48:52 GMT
cache-control: max-age=900, public
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (64903)
Size:   30370
Md5:    44f237857b8d03f32b53fe551e83c95a
Sha1:   91536fe6c60d947d29dfcb5f04d09b752b5ccf03
Sha256: a5e10dc2f3c729300afe8fe24aa430f57d91fdefa8112c0b35dd424ba612caa7
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "DC13C79816285AECAC295C2F6E074FD8251E11ADE0BF7450CC30D16A869A8EF2"
Last-Modified: Fri, 25 Nov 2022 08:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=10437
Expires: Sat, 26 Nov 2022 18:42:49 GMT
Date: Sat, 26 Nov 2022 15:48:52 GMT
Connection: keep-alive

                                        
                                            GET /s/roboto/v30/KFOmCnqEu92Fr1Mu4mxK.woff2 HTTP/1.1 
Host: fonts.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/font-woff2;q=1.0,application/font-woff;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: identity
Origin: https://20bet.com
Connection: keep-alive
Referer: https://fonts.googleapis.com/
Sec-Fetch-Dest: font
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.58.207.195
HTTP/2 200 OK
content-type: font/woff2
                                        
accept-ranges: bytes
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/apps-themes
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin; report-to="apps-themes"
report-to: {"group":"apps-themes","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/apps-themes"}]}
timing-allow-origin: *
content-length: 15744
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Wed, 23 Nov 2022 19:34:08 GMT
expires: Thu, 23 Nov 2023 19:34:08 GMT
cache-control: public, max-age=31536000
age: 245684
last-modified: Wed, 11 May 2022 19:24:48 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Web Open Font Format (Version 2), TrueType, length 15744, version 1.0\012- data
Size:   15744
Md5:    15d9f621c3bd1599f0169dcf0bd5e63e
Sha1:   7ca9c5967f3bb8bffeab24b639b49c1e7d03fa52
Sha256: f6734f8177112c0839b961f96d813fcb189d81b60e96c33278c1983b6f419615
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN


--- Additional Info ---
Magic:  data
Size:   69775
Md5:    41ca16e835f42c0619d27acd840ae0e0
Sha1:   6903fbd66804faaf6e42d033ecb3a32ff9eaa786
Sha256: ec146b0b0725588b1b152a77ded00217c1ece1fe6374d588a3dbc02f13f30522
                                        
                                            POST / HTTP/1.1 
Host: ocsp.entrust.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.110.10.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
ETag: "A8D3F328A64FCB8F2247AA64B78B5B6D81618F154BBC629DAA108877503D45AD"
Last-Modified: Sat, 26 Nov 2022 06:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=1892
Expires: Sat, 26 Nov 2022 16:20:24 GMT
Date: Sat, 26 Nov 2022 15:48:52 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   1588
Md5:    dada9992212156bf4e657bc22a2b5d46
Sha1:   a312ed4de67031991aeee100778d9ee69919645e
Sha256: a8d3f328a64fcb8f2247aa64b78b5b6d81618f154bbc629daa108877503d45ad
                                        
                                            POST / HTTP/1.1 
Host: ocsp.entrust.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.110.10.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
ETag: "A8D3F328A64FCB8F2247AA64B78B5B6D81618F154BBC629DAA108877503D45AD"
Last-Modified: Sat, 26 Nov 2022 06:00:00 UTC
Content-Length: 1588
Cache-Control: public, no-transform, must-revalidate, max-age=1843
Expires: Sat, 26 Nov 2022 16:19:35 GMT
Date: Sat, 26 Nov 2022 15:48:52 GMT
Connection: keep-alive


--- Additional Info ---
Magic:  data
Size:   1588
Md5:    dada9992212156bf4e657bc22a2b5d46
Sha1:   a312ed4de67031991aeee100778d9ee69919645e
Sha256: a8d3f328a64fcb8f2247aa64b78b5b6d81618f154bbc629daa108877503d45ad
                                        
                                            GET /dcs/tagController/tag/d3ea3fb1f9d4/homepage HTTP/1.1 
Host: zz.connextra.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.85.191.64
HTTP/2 200 OK
content-type: text/javascript;charset=utf-8
                                        
content-encoding: gzip
content-length: 16263
cache-control: must-revalidate, max-age=163
expires: Sat, 26 Nov 2022 15:51:35 GMT
date: Sat, 26 Nov 2022 15:48:52 GMT
vary: Accept-Encoding
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- exported SGML document, ASCII text, with very long lines (2407)
Size:   16263
Md5:    a48b7d649ea4ff6d54adcc1966fdf787
Sha1:   d8d4c0645613806cf861cfa1d793e40aca2748f0
Sha256: 1479166998807326fbc3aa71ab41a46597b3dc39c6e9c9b372c0a0286030add0
                                        
                                            GET /pixel?type=js&aid=1121&id=1859 HTTP/1.1 
Host: a.sportradarserving.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         3.121.170.91
HTTP/1.1 302 Moved Temporarily
                                        
Cache-Control: no-cache, no-store, must-revalidate
Date: Sat, 26 Nov 2022 15:48:52 GMT
Location: https://a.sportradarserving.com/ul_cb/pixel?type=js&aid=1121&id=1859
Set-Cookie: zuuid=ab046282-bc70-4948-9aa5-9b6d5fa62ee0; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure c=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure
Content-Length: 0
Connection: keep-alive

                                        
                                            GET /track.js?e=pageview&u=https%3A%2F%2F20bet.com%2Fcasino%3Fbtag%3D656524_3D81B86A9C4B4E02ACF86B3E8624D562&r=&i=DV-02355017850611493202&v=1.0.0&uid=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034&_nc=1669477732095 HTTP/1.1 
Host: tracker.growthbuddy.app
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         54.74.8.139
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 0
set-cookie: INGRESSCOOKIE=1669477733.169.114.681844|4755d7349ad2180cc27216e76023fb56; Path=/; Secure; HttpOnly
cache-control: no-cache
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2

                                        
                                            GET /sync?source=sr&redirect=//echoback.ads.sportradar.com/echoBack/_adsCookieSyncCallback?userId= HTTP/1.1 
Host: a.sportradarserving.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         3.121.170.91
HTTP/1.1 302 Moved Temporarily
                                        
Cache-Control: no-cache, no-store, must-revalidate
Date: Sat, 26 Nov 2022 15:48:52 GMT
Location: https://a.sportradarserving.com/ul_cb/sync?source=sr&redirect=//echoback.ads.sportradar.com/echoBack/_adsCookieSyncCallback?userId=
Set-Cookie: zuuid=b4088490-97cb-414e-93d3-2624d4307fc2; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure c=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure
Content-Length: 0
Connection: keep-alive

                                        
                                            GET /ul_cb/sync?source=sr&redirect=//echoback.ads.sportradar.com/echoBack/_adsCookieSyncCallback?userId= HTTP/1.1 
Host: a.sportradarserving.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Cookie: zuuid=b4088490-97cb-414e-93d3-2624d4307fc2; c=1669477732; zuuid_lu=1669477732
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         3.121.170.91
HTTP/1.1 302 Moved Temporarily
                                        
Cache-Control: no-cache, no-store, must-revalidate
Date: Sat, 26 Nov 2022 15:48:52 GMT
Location: https://x.bidswitch.net/syncd?dsp_id=409&user_group=1&user_id=b4088490-97cb-414e-93d3-2624d4307fc2&redir=https%3A%2F%2Fechoback.ads.sportradar.com%2FechoBack%2F_adsCookieSyncCallback%3FuserId%3Db4088490-97cb-414e-93d3-2624d4307fc2
Set-Cookie: zuuid=b4088490-97cb-414e-93d3-2624d4307fc2; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_k=1; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_k_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure
Content-Length: 0
Connection: keep-alive

                                        
                                            GET /ul_cb/pixel?type=js&aid=1121&id=1859 HTTP/1.1 
Host: a.sportradarserving.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Cookie: zuuid=ab046282-bc70-4948-9aa5-9b6d5fa62ee0; c=1669477732; zuuid_lu=1669477732
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         3.121.170.91
HTTP/1.1 200 OK
Content-Type: text/javascript; charset=UTF-8
                                        
Cache-Control: no-cache, no-store, must-revalidate
Date: Sat, 26 Nov 2022 15:48:52 GMT
Set-Cookie: zuuid=ab046282-bc70-4948-9aa5-9b6d5fa62ee0; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_k=1; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure zuuid_k_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure bss=!bidswitch,438734932; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure cm2=!bidswitch,438806932; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=sportradarserving.com; samesite=none; secure
Content-Length: 2325
Connection: keep-alive


--- Additional Info ---
Magic:  ASCII text, with very long lines (2325), with no line terminators
Size:   2325
Md5:    491dfe6ff4799b0811758fd54fc844e5
Sha1:   536b10e10f8a440938347259c5c6a00cf83337fc
Sha256: 15b5ed9b9917feb2784e035181d65e1d7201be9789b6d90d215078f52d7eff09
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.156
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: max-age=121536
Date: Sat, 26 Nov 2022 15:48:52 GMT
Etag: "63815e24-1d7"
Expires: Mon, 28 Nov 2022 01:34:28 GMT
Last-Modified: Sat, 26 Nov 2022 00:30:28 GMT
Server: ECS (bsa/EB22)
X-Cache: Miss from cloudfront
Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: rEo9_pCNNsnityxHaHSUbEyxmsJkNANM8tsmfbWO_BKckLFOqbureQ==
Age: 3840

                                        
                                            POST /s/gts1d4/tTkxSEAAs8c HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 471
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            POST /s/gts1d4/mxoWbFvua2o HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Cache-Control: public, max-age=14400
Server: scaffolding on HTTPServer2
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /1/usersyncs?b=8461718b-151b-486e-8ea2-a9b349f07f98&u=ab046282-bc70-4948-9aa5-9b6d5fa62ee0 HTTP/1.1 
Host: tags.feedad.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         216.239.36.21
HTTP/2 200 OK
content-type: image/gif
                                        
set-cookie: fa_8461718b-151b-486e-8ea2-a9b349f07f98_u=ab046282-bc70-4948-9aa5-9b6d5fa62ee0; Domain=.feedad.com; Path=/; Max-Age=2592000; HttpOnly; SameSite=None; Secure
x-cloud-trace-context: 2e6eee2b87f8782f3cd67dfe09b58f73
date: Sat, 26 Nov 2022 15:48:52 GMT
server: Google Frontend
content-length: 42
expires: Sat, 26 Nov 2022 15:48:52 GMT
cache-control: private
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   42
Md5:    d89746888da2d9510b64a9f031eaecd5
Sha1:   d5fceb6532643d0d84ffe09c40c481ecdf59e15a
Sha256: ef1955ae757c8b966c83248350331bd3a30f658ced11f387f8ebf05ab3368629
                                        
                                            GET /c/hotjar-2053477.js?sv=6 HTTP/1.1 
Host: static.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.230.111.8
HTTP/2 200 OK
content-type: application/javascript; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:47 GMT
access-control-allow-origin: *
cache-control: max-age=60
content-encoding: br
cross-origin-resource-policy: cross-origin
etag: W/d228f93bbeb3ca2c4a75c92587618453
strict-transport-security: max-age=2592000; includeSubDomains
x-cache-hit: 1
x-content-type-options: nosniff
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 0c35b89cb607eddb1b7cc5d6ada865d6.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-P1
x-amz-cf-id: RoSginI_2DwjprJi9jovJNe_3Ux61_zlE2oT5-SLUrCDzze2oGacdQ==
age: 5
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (5909)
Size:   3349
Md5:    ba27b13eb01d45f7218ece1cf0d8c794
Sha1:   3b2fc26c0fcbade5fae76ba43b03b63fb368bcb0
Sha256: 73bcd92f8a15508bb8492dbe7c106dabfa6316d1bb39f3b67002221278200b74
                                        
                                            GET /analytics.js HTTP/1.1 
Host: www.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.174
HTTP/2 200 OK
content-type: text/javascript
                                        
strict-transport-security: max-age=10886400; includeSubDomains; preload
x-content-type-options: nosniff
vary: Accept-Encoding
content-encoding: gzip
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 20039
date: Sat, 26 Nov 2022 14:41:08 GMT
expires: Sat, 26 Nov 2022 16:41:08 GMT
cache-control: public, max-age=7200
age: 4064
last-modified: Tue, 27 Sep 2022 22:01:05 GMT
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (1325)
Size:   20039
Md5:    47e6f374ca946fddd5b59871b325736c
Sha1:   baa9282efc8785e84d247c3bff518eaa45f101c4
Sha256: 16580b5c87c58e5702e411f1888fdef511094e4cd6d62bb47d16291ffb25985e
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4552
Cache-Control: max-age=150721
Date: Sat, 26 Nov 2022 15:48:52 GMT
Etag: "6381cd5d-1d7"
Expires: Mon, 28 Nov 2022 09:40:53 GMT
Last-Modified: Sat, 26 Nov 2022 08:25:01 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /tag_gen.js HTTP/1.1 
Host: a.exoclick.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         205.185.216.10
HTTP/1.1 200 OK
Content-Type: application/javascript
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Connection: Keep-Alive
Content-Encoding: gzip
Content-Length: 515
Accept-Ranges: bytes
Cache-Control: max-age=10800
Server: nginx
etag: W/"a56c0470b9aa925085e51a6271a"
X-HW: 1669477732.dop022.sk1.t,1669477732.cds231.sk1.shn,1669477732.dop022.sk1.t,1669477732.cds251.sk1.c
Access-Control-Allow-Origin: *, *


--- Additional Info ---
Magic:  ASCII text, with very long lines (1030), with no line terminators
Size:   515
Md5:    628e0302068ade64b5f411f39d5ce7e5
Sha1:   ff1a609269f34bad5ae67ed1678df3f7b905d018
Sha256: c583ceaeae2e9a05e25c27b61520710f16b8b98ca7f9087a75ae90a040b8bc3f
                                        
                                            GET /en_US/fbevents.js HTTP/1.1 
Host: connect.facebook.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         31.13.72.12
HTTP/2 200 OK
content-type: application/x-javascript; charset=utf-8
                                        
vary: Accept-Encoding
content-encoding: gzip
content-security-policy: default-src facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com data: blob: 'self';script-src *.fbcdn.net *.facebook.net 'unsafe-inline' 'unsafe-eval' blob: data: 'self';style-src data: blob: 'unsafe-inline' facebook.net *.facebook.net fbcdn.net *.fbcdn.net fbsbx.com *.fbsbx.com;connect-src *.fbcdn.net *.facebook.net wss://*.fbcdn.net attachment.fbsbx.com blob: 'self';block-all-mixed-content;upgrade-insecure-requests;report-uri https://www.facebook.com/csp/reporting/?m=c&minimize=0;
x-fb-rlafr: 0
document-policy: force-load-at-top
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups
pragma: public
cache-control: public, max-age=1200
expires: Sat, 01 Jan 2000 00:00:00 GMT
x-content-type-options: nosniff
x-xss-protection: 0
x-frame-options: DENY
strict-transport-security: max-age=31536000; preload; includeSubDomains
x-fb-debug: N1OEkA0Hx/A290mqScBeDfOB70tLXRA3+UUNXI6RYNl1p1sYJ4S2akaGZ3PSDOeidiczenCh0cprUD/UMRPaXQ==
content-length: 27340
x-fb-trip-id: 1904183273
date: Sat, 26 Nov 2022 15:48:52 GMT
alt-svc: h3=":443"; ma=86400
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (64348)
Size:   27340
Md5:    44ecaa3c2a4929a40141edc4540aaf84
Sha1:   f29a573182333b2500d41bfc389d6c5232dfb348
Sha256: 6589fe14578dedd4df678a909afadd7e5bc7f57c7e3e24518a7f5faac7383396
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4612
Cache-Control: max-age=86362
Date: Sat, 26 Nov 2022 15:48:52 GMT
Etag: "6380d1bb-13a"
Expires: Sun, 27 Nov 2022 15:48:14 GMT
Last-Modified: Fri, 25 Nov 2022 14:31:23 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 314

                                        
                                            GET /assets/favicon.png HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: image/png
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 9320
cf-ray: 7703c5547aaa991b-ARN
accept-ranges: bytes
etag: "637def2d-2468"
last-modified: Wed, 23 Nov 2022 10:00:13 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 129 x 128, 8-bit/color RGBA, non-interlaced\012- data
Size:   9320
Md5:    76d3202979d99d33720b7b189cf8bc23
Sha1:   81cba7c933e4e332ea31208c388307d49bf1c1c8
Sha256: 7731ec4a0f05418aaf44b5d3b8010c5470303578fed1331bc18089fc802b2a96
                                        
                                            GET /assets/favicon.png HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: image/png
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 9320
cf-ray: 7703c5547aac991b-ARN
accept-ranges: bytes
etag: "637def1f-2468"
last-modified: Wed, 23 Nov 2022 09:59:59 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  PNG image data, 129 x 128, 8-bit/color RGBA, non-interlaced\012- data
Size:   9320
Md5:    76d3202979d99d33720b7b189cf8bc23
Sha1:   81cba7c933e4e332ea31208c388307d49bf1c1c8
Sha256: 7731ec4a0f05418aaf44b5d3b8010c5470303578fed1331bc18089fc802b2a96
                                        
                                            POST /gseccovsslca2018 HTTP/1.1 
Host: ocsp.globalsign.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 79
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.20.226
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Content-Length: 937
Connection: keep-alive
Expires: Wed, 30 Nov 2022 14:00:10 GMT
ETag: "f139ab1a0ccc6a93d362f118bba31c839f267c3e"
Last-Modified: Sat, 26 Nov 2022 14:00:11 GMT
Cache-Control: public, no-transform, must-revalidate, s-maxage=3600
CF-Cache-Status: HIT
Age: 3057
Accept-Ranges: bytes
Vary: Accept-Encoding
Server: cloudflare
CF-RAY: 7703c5555a380b49-OSL

                                        
                                            GET /ctrack?action=list&type=add&id=notregistered&context=20bet.com&cookiename=notregistered&age=262800&maxcookiecount=10 HTTP/1.1 
Host: ctrack.trafficjunky.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         66.254.114.89
HTTP/1.1 200 OK
content-type: image/gif
                                        
server: openresty
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 35
cache-control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Sun, 22 Jan 1984 03:00:00 GMT
p3p: CP="IDC DSP COR CURa ADMa OUR IND PHY ONL COM STA"
pragma: no-cache
set-cookie: tj_UUID=631cd2ee2b4f4cf89a98c513c08d9583; Path=/; Domain=trafficjunky.net; Expires=Mon, 26 Dec 2022 15:48:52 GMT; Secure; SameSite=None tj_UUID_v2=631cd2ee-2b4f-4cf8-9a98-c513c08d9583; Path=/; Domain=trafficjunky.net; Expires=Mon, 26 Dec 2022 15:48:52 GMT; Secure; SameSite=None 1918bc62c1a6d87456120b5ac922270e=notregistered; Path=/; Domain=trafficjunky.net; Expires=Sun, 28 May 2023 03:48:52 GMT; Secure; SameSite=None
access-control-allow-origin: *
access-control-allow-credentials: true
access-control-allow-methods: GET,POST
access-control-allow-headers: Content-Type
access-control-max-age: 86400
x-request-id: 63823564-42FE725901BB1147B-301BCEA


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   35
Md5:    28d6814f309ea289f847c69cf91194c6
Sha1:   0f4e929dd5bb2564f7ab9c76338e04e292a42ace
Sha256: 8337212354871836e6763a41e615916c89bac5b3f1f0adf60ba43c7c806e1015
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sca1b.amazontrust.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         143.204.42.156
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Content-Length: 471
Connection: keep-alive
Accept-Ranges: bytes
Cache-Control: 'max-age=158059'
Date: Sat, 26 Nov 2022 15:48:52 GMT
Last-Modified: Sat, 26 Nov 2022 14:54:39 GMT
Server: ECS (bsa/EB1D)
X-Cache: Miss from cloudfront
Via: 1.1 e49f22f18c16784c0f42291e768d1daa.cloudfront.net (CloudFront)
X-Amz-Cf-Pop: OSL50-C1
X-Amz-Cf-Id: -T8xC7tnZI8HQLg8c467lJRmSUe6aVZjg3oiYLEiNrqpoqxwKocUhQ==
Age: 3253

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 26 Nov 2022 01:56:51 GMT
Expires: Sat, 03 Dec 2022 01:56:50 GMT
Etag: "1298f0c1b78880a93b57d06eeecddc8f668208b9"
Cache-Control: max-age=554277,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb1
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7703c5555d3c1bfa-OSL

                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 26 Nov 2022 01:56:51 GMT
Expires: Sat, 03 Dec 2022 01:56:50 GMT
Etag: "1298f0c1b78880a93b57d06eeecddc8f668208b9"
Cache-Control: max-age=554277,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7703c5555a4d1c0a-OSL

                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 3689
Cache-Control: max-age=138694
Date: Sat, 26 Nov 2022 15:48:52 GMT
Etag: "6381a1c1-1d7"
Expires: Mon, 28 Nov 2022 06:20:26 GMT
Last-Modified: Sat, 26 Nov 2022 05:18:57 GMT
Server: ECS (ska/F71A)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /xuid?mid=7963&xuid=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&dongle=3oy7 HTTP/1.1 
Host: eb2.3lift.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         13.248.245.213
HTTP/2 200 OK
content-type: image/gif
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 37
cache-control: no-cache, no-store, must-revalidate
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   37
Md5:    3eacd0132310ea44cad756b378a3bc07
Sha1:   e2216a7e9b73f5cb0279351c78ce61c33475cea7
Sha256: bb229a48bee31f5d54ca12dc9bd960c63a671f0d4be86a054c1d324a44499d96
                                        
                                            GET /tag.js?id=DV-02355017850611493202 HTTP/1.1 
Host: tag.growthbuddy.app
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         54.74.8.139
HTTP/2 200 OK
content-type: application/javascript; charset=utf-8
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
set-cookie: INGRESSCOOKIE=1669477733.096.114.686392|5f2e1b57d78510d04b0cf9036879032b; Path=/; Secure; HttpOnly
vary: Accept-Encoding
cache-control: public, max-age=7200
x-content-type-options: nosniff
etag: "1382-4YuDa3owVc9r2LUx5CM7dj7oB9U"
content-encoding: gzip
strict-transport-security: max-age=15724800; includeSubDomains
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (4966)
Size:   1969
Md5:    b6e25997407245f0f6095b9865dc3828
Sha1:   bee1656f82ca83a9315759c80a5e3e91b53eabc7
Sha256: 94c80d2b5cf48e280ce2d53a629a003576a7f1b303b7b397103afc0ab1129ab7
                                        
                                            GET /app/main.00861646f5d4e1ee.esm.js HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
cf-ray: 7703c551cfb0991b-ARN
etag: W/"637deef7-15c364"
last-modified: Wed, 23 Nov 2022 09:59:19 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   364345
Md5:    330e79cf06369f959b3b426ee4f77b54
Sha1:   1d7ec4ae7bf1882f3a97c9b156b6cac1ecb3259c
Sha256: 12e6e014d0b6c2dce0e12651d633a99cf4e400f786c4175ae5a0307c67ad161c
                                        
                                            GET /syncd?dsp_id=409&user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&user_group=2&redir=%2F%2Feu.sportradarserving.com%2Fbsw_sync%3Fbsw_uid%3D%24%7BBSW_UID%7D HTTP/1.1 
Host: x.bidswitch.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         52.29.215.78
HTTP/2 302 Found
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 0
location: https://x.bidswitch.net/ul_cb/syncd?dsp_id=409&user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&user_group=2&redir=%2F%2Feu.sportradarserving.com%2Fbsw_sync%3Fbsw_uid%3D%24%7BBSW_UID%7D
cache-control: no-cache, no-store, must-revalidate
set-cookie: tuuid=d2f1043a-34d0-45db-8b10-b8217fae1790; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=.bidswitch.net; samesite=none; secure c=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=.bidswitch.net; samesite=none; secure tuuid_lu=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=.bidswitch.net; samesite=none; secure c=1669477732; path=/; expires=Sun, 26-Nov-2023 15:48:52 GMT; domain=.bidswitch.net; samesite=none; secure
X-Firefox-Spdy: h2

                                        
                                            GET /metrika/tag.js HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.158.134.119
HTTP/2 200 OK
content-type: application/javascript
                                        
content-length: 73267
date: Sat, 26 Nov 2022 15:48:52 GMT
access-control-allow-origin: *
etag: "637f41b2-11e33"
expires: Sat, 26 Nov 2022 16:48:52 GMT
last-modified: Thu, 24 Nov 2022 13:04:34 GMT
cache-control: max-age=3600
content-encoding: br
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  Unicode text, UTF-8 (with BOM) text, with very long lines (587)
Size:   73267
Md5:    1d79426653c3b55939eaec59a2ce8ef5
Sha1:   c6db0314df7a4e5c08047f6306e0b79a1ad3bab2
Sha256: 2729cfe8b2f5142cf99734cbb4e1a3c6cd35868d279cd796db49ef62742ef993
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 26 Nov 2022 01:56:51 GMT
Expires: Sat, 03 Dec 2022 01:56:50 GMT
Etag: "1298f0c1b78880a93b57d06eeecddc8f668208b9"
Cache-Control: max-age=554277,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb3
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7703c555599f0b4d-OSL

                                        
                                            POST /g/collect?v=2&tid=G-J9LNZYMXZE&gtm=2oeb90&_p=2015541371&cid=461384038.1669477732&ul=en-us&sr=1280x1024&_s=1&sid=1669477732&sct=1&seg=0&dl=https%3A%2F%2F20bet.com%2Fcasino%3Fbtag%3D656524_3D81B86A9C4B4E02ACF86B3E8624D562&dt=Best%20Online%20Casino%20to%20Win%20Real%20Money%20%C2%BB%20Play%20at%2020Bet%20Legally&en=page_view&_fv=1&_nsi=1&_ss=1 HTTP/1.1 
Host: region1.google-analytics.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Content-Length: 0

search
                                         216.239.34.36
HTTP/2 204 No Content
content-type: text/plain
                                        
access-control-allow-origin: https://20bet.com
date: Sat, 26 Nov 2022 15:48:52 GMT
pragma: no-cache
expires: Fri, 01 Jan 1990 00:00:00 GMT
cache-control: no-cache, no-store, must-revalidate
access-control-allow-credentials: true
cross-origin-resource-policy: cross-origin
server: Golfe2
content-length: 0
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2

                                        
                                            GET /syncd?dsp_id=409&user_group=1&user_id=b4088490-97cb-414e-93d3-2624d4307fc2&redir=https%3A%2F%2Fechoback.ads.sportradar.com%2FechoBack%2F_adsCookieSyncCallback%3FuserId%3Db4088490-97cb-414e-93d3-2624d4307fc2 HTTP/1.1 
Host: x.bidswitch.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         52.29.215.78
HTTP/2 200 OK
content-type: image/gif
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
content-length: 43
cache-control: no-cache, no-store, must-revalidate
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            POST / HTTP/1.1 
Host: ocsp.sectigo.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.32.68
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:52 GMT
Content-Length: 471
Connection: keep-alive
Last-Modified: Sat, 26 Nov 2022 01:56:51 GMT
Expires: Sat, 03 Dec 2022 01:56:50 GMT
Etag: "1298f0c1b78880a93b57d06eeecddc8f668208b9"
Cache-Control: max-age=554277,s-maxage=1800,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb6
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 7703c5557911fab4-OSL

                                        
                                            GET /push-worker.js HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Service-Worker: script
Connection: keep-alive
Cookie: preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Sec-Fetch-Dest: serviceworker
Sec-Fetch-Mode: same-origin
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 404 Not Found
content-type: text/html; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
cf-ray: 7703c550eeb6991b-ARN
cache-control: max-age=0, must-revalidate, private
expires: Sat, 26 Nov 2022 15:48:52 GMT
vary: Accept-Encoding
cf-cache-status: BYPASS
access-control-allow-credentials: true
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization
access-control-allow-methods: GET, POST, OPTIONS
access-control-expose-headers: Content-Length,Content-Range
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, Unicode text, UTF-8 text, with very long lines (5429), with CRLF, LF line terminators
Size:   7593
Md5:    a49d534f4397cde4f00ba52e5b4e3d1c
Sha1:   19b14ffaf37c827f262eb9fe8dee50ca844189eb
Sha256: ceb25f971c2f862a437ac2208cd4849fcfa71d5b8a7e8ce9b3f8b7f166f1afea
                                        
                                            GET /tracking/cssession?tst&id=22441 HTTP/1.1 
Host: dsp-trk.eskimi.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         34.120.139.69
HTTP/2 304 Not Modified
                                        
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
date: Sat, 26 Nov 2022 15:48:53 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2

                                        
                                            OPTIONS /api/market-descriptions/get-all-markets/en HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5577e95991b-ARN
X-Firefox-Spdy: h2

                                        
                                            OPTIONS /api/match-statuses/get-all/en HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5577e97991b-ARN
X-Firefox-Spdy: h2

                                        
                                            GET /app/common.68e049bd60bde3ea.css HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: text/css
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
cf-ray: 7703c556adab991b-ARN
etag: W/"637def08-d68"
last-modified: Wed, 23 Nov 2022 09:59:36 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  assembler source, ASCII text, with very long lines (3432), with no line terminators
Size:   1048
Md5:    123d265c3ce0fb8dddaf2cd6a897380f
Sha1:   b31f26da9fbfbd426549cbdb0aeb6983c934a04b
Sha256: 75d4985bec6ceb2f8f459471c7dce506deadf23af4860c2fcdbceaa7d5df71f8
                                        
                                            POST / HTTP/1.1 
Host: ocsp.digicert.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 83
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         93.184.220.29
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Accept-Ranges: bytes
Age: 4968
Cache-Control: max-age=151136
Date: Sat, 26 Nov 2022 15:48:53 GMT
Etag: "6381cd5d-1d7"
Expires: Mon, 28 Nov 2022 09:47:49 GMT
Last-Modified: Sat, 26 Nov 2022 08:25:01 GMT
Server: ECS (ska/F70F)
X-Cache: HIT
Content-Length: 471

                                        
                                            GET /v2/gtr?id=22441&url=https%3A%2F%2F20bet.com%2Fcasino%3Fbtag%3D656524_3D81B86A9C4B4E02ACF86B3E8624D562&t=1669477732927 HTTP/1.1 
Host: dsp-ap.eskimi.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         35.186.201.99
HTTP/2 200 OK
content-type: application/json
                                        
set-cookie: __eConsent=1; Expires=Mon, 26 Dec 2022 15:48:53 GMT; Max-Age=2592000; Domain=.eskimi.com; Path=/; Secure; SameSite=None __eDId=6218a11c-1aa9-4b0c-b4b7-4d887cfdf2fe; Expires=Mon, 26 Dec 2022 15:48:53 GMT; Max-Age=2592000; Domain=.eskimi.com; Path=/; Secure; SameSite=None __eP=1; Expires=Sat, 10 Dec 2022 15:48:53 GMT; Max-Age=1209600; Domain=.eskimi.com; Path=/; Secure; SameSite=None
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
cache-control: no-cache
date: Sat, 26 Nov 2022 15:48:52 GMT
via: 1.1 google
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with no line terminators
Size:   116
Md5:    055450d34b2087f55c61cf101aa72f2c
Sha1:   3b3ece0ef2b1443f196e71a70164af54d01fcf92
Sha256: 0d14f0d8d002ebc3f091407c8e315f7d7c704870109efc76aa0c2f2baff869d2
                                        
                                            OPTIONS /api/status HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5578eb1991b-ARN
X-Firefox-Spdy: h2

                                        
                                            POST / HTTP/1.1 
Host: r3.o.lencr.org
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 85
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         23.36.77.32
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Server: nginx
Content-Length: 503
ETag: "43BBB48A1A37A33C18036773457C75408E907C1FD7297A42152AEE29F396066E"
Last-Modified: Thu, 24 Nov 2022 05:00:00 UTC
Cache-Control: public, no-transform, must-revalidate, max-age=6650
Expires: Sat, 26 Nov 2022 17:39:43 GMT
Date: Sat, 26 Nov 2022 15:48:53 GMT
Connection: keep-alive

                                        
                                            GET /tag.php?goal=8b2e6ea6f4f288415527d8eb7f5c3dc2 HTTP/1.1 
Host: main.exdynsrv.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         95.211.229.245
HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
                                        
Server: nginx
Date: Sat, 26 Nov 2022 15:48:53 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Set-Cookie: goals=a%3A1%3A%7Bi%3A93090%3Ba%3A1%3A%7Bs%3A4%3A%22date%22%3Bs%3A10%3A%222022-11-26%22%3B%7D%7D; expires=Sun, 26 Nov 2023 15:48:53 GMT; path=/; domain=.exdynsrv.com; Secure; SameSite=none
X-Robots-Tag: noindex, follow
Content-Encoding: gzip

                                        
                                            GET /app/common.20a7ec869b4d5a4b.esm.js HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
cf-ray: 7703c556adac991b-ARN
etag: W/"637deef1-7eb5"
last-modified: Wed, 23 Nov 2022 09:59:13 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (32437), with no line terminators
Size:   10066
Md5:    c7cea7cd9dc070c6d1461ffb9056f2dc
Sha1:   cfcd1b3ed0760d9bca62f97c1def86bb58c01fbf
Sha256: e490558d70157ff39cffe543db29d572fb107142ed36700a0a3d02e9e6ef5dc9
                                        
                                            OPTIONS /api/v2/ip-data HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557aece991b-ARN
X-Firefox-Spdy: h2

                                        
                                            GET /beacon.min.js/vaafb692b2aea4879b33c060e79fe94621666317369993 HTTP/1.1 
Host: static.cloudflareinsights.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.16.57.101
HTTP/2 200 OK
content-type: text/javascript;charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:51 GMT
access-control-allow-origin: *
cache-control: public, max-age=86400
etag: W/2022.10.1
last-modified: Fri, 21 Oct 2022 01:56:09 GMT
cross-origin-resource-policy: cross-origin
vary: Accept-Encoding
server: cloudflare
cf-ray: 7703c54e2cc10b61-OSL
content-encoding: gzip
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (17031), with no line terminators
Size:   6158
Md5:    dfd1fdd9197381188d9240427038f970
Sha1:   85135c355457345ea5c9d08ef12a7f872cdb363b
Sha256: c6307b7ecc7e28db203c3ba4660652eaa799fc238bd8b810374c9f4cd162e549
                                        
                                            GET /assets/registration_loader.gif HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: image/gif
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
content-length: 190218
cf-ray: 7703c556dde1991b-ARN
accept-ranges: bytes
etag: "637def34-2e70a"
last-modified: Wed, 23 Nov 2022 10:00:20 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 200 x 200\012- data
Size:   190218
Md5:    970c1b0852106da323f78bc2b065eede
Sha1:   843e9db8df957182ec32f5bc8a1e74a3249655d0
Sha256: 11de3d33b7be490a6be50e32f995e8ce2e4a6d12a748e0363dcabd976dec1b4a
                                        
                                            GET /app/styles.a1f6fc82d7ce3311.css HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/css,*/*;q=0.1
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Sec-Fetch-Dest: style
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: text/css
                                        
date: Sat, 26 Nov 2022 15:48:51 GMT
cf-ray: 7703c54ddadd991b-ARN
etag: W/"637deef2-2377c"
last-modified: Wed, 23 Nov 2022 09:59:14 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (65536), with no line terminators
Size:   67037
Md5:    ec3b0e0724bebfb4f831e50652ff5fbb
Sha1:   6275e90cd013ef53a993b6b6fa4f2c612a22f4ab
Sha256: d71a918efc86d4e5e3f501e56ea22fb483d0e152552d7d85886a2d315032378d
                                        
                                            OPTIONS /api/data/provinces HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557bee1991b-ARN
X-Firefox-Spdy: h2

                                        
                                            OPTIONS /api/data/get-currencies HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557ceef991b-ARN
X-Firefox-Spdy: h2

                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /app/5505.459b039b737dea4c.esm.js HTTP/1.1 
Host: 20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/casino?btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562
Cookie: is_mobile_device=false; preferred-language=en; btag=656524_3D81B86A9C4B4E02ACF86B3E8624D562; _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: same-origin
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/javascript
                                        
date: Sat, 26 Nov 2022 15:48:52 GMT
cf-ray: 7703c556ada6991b-ARN
etag: W/"637def07-8ad6"
last-modified: Wed, 23 Nov 2022 09:59:35 GMT
set-cookie: is_mobile_device=false
vary: Accept-Encoding
cf-cache-status: BYPASS
server: cloudflare
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (35542), with no line terminators
Size:   10996
Md5:    30446c40eecf636c7360195e78090ecf
Sha1:   a43572ec3bcfbd55266c1f124c34bbf6c6b11e88
Sha256: 5baf3273957f291627fbefed14e03d63b198a736332c69b346d8959a0050010c
                                        
                                            GET /recaptcha/api.js?render=6LeYXFIiAAAAAEinEF15OsBYNq5UXwmor7zuYO0g HTTP/1.1 
Host: www.google.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.164
HTTP/2 200 OK
content-type: text/javascript; charset=UTF-8
                                        
expires: Sat, 26 Nov 2022 15:48:53 GMT
date: Sat, 26 Nov 2022 15:48:53 GMT
cache-control: private, max-age=300
cross-origin-resource-policy: cross-origin
content-encoding: gzip
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
content-security-policy: frame-ancestors 'self'
x-xss-protection: 1; mode=block
content-length: 583
server: GSE
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (884), with no line terminators
Size:   583
Md5:    0391e5b907187f59669f5c361a1aa817
Sha1:   ead959f80500bc9f20bc30ba68928950565dc2cf
Sha256: 6f137c3a3503a6c88114d5c80a513a2c327d9f9ec00902fa0f27be36afc679d9
                                        
                                            OPTIONS /api/market-descriptions/get-all-outcomes/en HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Access-Control-Request-Method: GET
Access-Control-Request-Headers: client-timezone,content-type,x-requested-with
Referer: https://20bet.com/
Origin: https://20bet.com
Connection: keep-alive
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         172.67.15.187
HTTP/2 204 No Content
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
access-control-max-age: 86400
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557bc930b49-OSL
X-Firefox-Spdy: h2

                                        
                                            GET /public/sg.js HTTP/1.1 
Host: casino.cur.a8r.games
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         104.18.12.198
HTTP/2 200 OK
content-type: text/javascript; charset=utf-8
                                        
date: Sat, 26 Nov 2022 15:48:51 GMT
vary: Accept-Encoding
strict-transport-security: max-age=15724800; includeSubDomains
content-encoding: gzip
last-modified: Sat, 26 Nov 2022 15:25:31 GMT
cf-cache-status: HIT
age: 1141
expires: Sat, 26 Nov 2022 19:48:51 GMT
cache-control: public, max-age=14400
server: cloudflare
cf-ray: 7703c54e3b860b65-OSL
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  data
Size:   443342
Md5:    871f6e1df7851b985f4762db2e0edf45
Sha1:   ce6fa0e292f81b45f46b127119e73883f088dee4
Sha256: cfd0809eec6e7680b131a9651c90e6f71f0873202cebd2434e19a04a08d82f59
                                        
                                            GET /api/market-group-sorting/get-all-ordered HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5581f4a991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (23833), with no line terminators
Size:   4200
Md5:    7ee05420d8249d933efb89d3771ea514
Sha1:   ca348eaf7104e5f9b865cf87314f9fb6d9756251
Sha256: a70cea760223d6aa41dcfb7daca44cb19b7f313a9143a24cafb3ba8705389866
                                        
                                            GET /box-5e66f98b4ee957db209dc6f63e3d59dd.html HTTP/1.1 
Host: vars.hotjar.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: iframe
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: cross-site

search
                                         143.204.55.118
HTTP/2 200 OK
content-type: text/html
                                        
content-length: 1035
date: Wed, 23 Nov 2022 13:10:06 GMT
accept-ranges: bytes
cache-control: max-age=31536000
content-encoding: br
cross-origin-embedder-policy: require-corp
cross-origin-resource-policy: cross-origin
etag: "e0652b84b7b3b650769c759fc520c3f8"
last-modified: Wed, 23 Nov 2022 13:09:18 GMT
strict-transport-security: max-age=2592000; includeSubDomains
x-robots-tag: none
vary: Accept-Encoding
x-cache: Hit from cloudfront
via: 1.1 a034aae43a19aef875fa395182990970.cloudfront.net (CloudFront)
x-amz-cf-pop: OSL50-C1
x-amz-cf-id: lUUpgNnYojvpm8ALiU90lusZ7qqvkGErYUNAwLENRnVsnSBAn1R8IQ==
age: 268727
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  HTML document text\012- HTML document text\012- HTML document text\012- HTML document text\012- exported SGML document, ASCII text, with very long lines (2368), with no line terminators
Size:   1035
Md5:    e0652b84b7b3b650769c759fc520c3f8
Sha1:   0b55d6e28613350c7f41b88f19e726e6751ad03b
Sha256: 94b4c240f83065223dcacdd3f8b69cb229d0616edc3e2041eef3e270d859fc3d
                                        
                                            GET /api/data/provinces HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5582f5e991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (1894), with no line terminators
Size:   840
Md5:    baf1297366fdf0e03fcb96bcd3956137
Sha1:   8a49c0051b6c2f118de77eb8c602833a32adbc97
Sha256: cc67418fc2d38173180f29a352d32cd041a2514e120fdf4e82e1dfbaf892f0cb
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /api/v1/retargeting/set/45d3301c-de08-443f-9716-ba31e2632331 HTTP/1.1 
Host: tsyndicate.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         162.55.130.248
HTTP/2 200 OK
content-type: text/plain; charset=utf-8
                                        
server: nginx
date: Sat, 26 Nov 2022 15:48:53 GMT
content-length: 35
pragma: no-cache
expires: 0
vary: *
x-api-version: 1
x-request-id: 542e9d4a48b97525
set-cookie: ts_rt_45d3301c-de08-443f-9716-ba31e2632331=AAMC; expires=Sun, 26 Nov 2023 15:48:53 GMT; path=/; HttpOnly; secure; SameSite=None
cache-control: no-cache, no-store, no-transform, must-revalidate, no-transform
x-robots-tag: none, noindex, nofollow
report-to: { "url": "https://pxl.tsyndicate.com/api/v1/heavy-ad/report", "max_age": 86401 }
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   35
Md5:    c2196de8ba412c60c22ab491af7b1409
Sha1:   5fbd472222feb8a22cf5b8aa5dc5b8e13af88e2b
Sha256: 6adc3d4c1056996e4e8b765a62604c78b1f867cceb3b15d0b9bedb7c4857f992
                                        
                                            GET /api/v2/configurations HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557ef15991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size:   6274
Md5:    85ab2d75e2178e9c1fad69988f551a3f
Sha1:   419adb2e1f7d0c4639c2c12d9a6e3555521a9812
Sha256: 2de7dc8ffb898ed75875c1271ebfdf5bf8927d6b1427122b3eeada89a0b49cf3
                                        
                                            POST /gts1c3 HTTP/1.1 
Host: ocsp.pki.goog
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/ocsp-request
Content-Length: 84
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.3
HTTP/1.1 200 OK
Content-Type: application/ocsp-response
                                        
Date: Sat, 26 Nov 2022 15:48:53 GMT
Cache-Control: public, max-age=14400
Server: ocsp_responder
Content-Length: 472
X-XSS-Protection: 0
X-Frame-Options: SAMEORIGIN

                                        
                                            GET /api/market-descriptions/get-all-outcomes/en HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c558980b991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size:   80817
Md5:    93625d79e1bdcd48c2d86cb45d092b24
Sha1:   43b1070560cf138b0a420d3d1e3c69f96498072b
Sha256: 04f5e893481d2a63b6063eb03c6484fac78b4030dd594795d4b211e895f453d8
                                        
                                            GET /ul_cb/sync?dsp_id=409&expires=14&user_group=2&user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&cb=4fffd669-ac95-49fa-a1a1-d62186b234b4 HTTP/1.1 
Host: x.bidswitch.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         52.29.215.78
HTTP/2 302 Found
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
content-length: 0
cache-control: no-cache, no-store, must-revalidate
location: //match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=&seat_user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&seat_key=409&gdpr=&gdpr_consent=&gdpr_pd=&usprivacy=
X-Firefox-Spdy: h2

                                        
                                            GET /api/market-descriptions/get-all-markets/en HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c557cef2991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (65536), with no line terminators
Size:   27080
Md5:    2d447eecc2910a39b12174332fd98715
Sha1:   dcca5b9a8a7e8272ae7c8e72028c37e68d46ccdc
Sha256: ff7f3811cb002bb825e485f7576e0234efbbae5404d902e9d05e694095f53ae4
                                        
                                            GET /ul_cb/sync?dsp_id=409&expires=14&user_group=2&user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&cb=f7a41ffc-5b57-4ba2-abf8-37c90a1f3ca7 HTTP/1.1 
Host: x.bidswitch.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         52.29.215.78
HTTP/2 302 Found
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
content-length: 0
cache-control: no-cache, no-store, must-revalidate
location: //match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=&seat_user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&seat_key=409&gdpr=&gdpr_consent=&gdpr_pd=&usprivacy=
X-Firefox-Spdy: h2

                                        
                                            GET /api/data/get-currencies HTTP/1.1 
Host: platform.20bet.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: application/json
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Content-Type: application/json
X-Requested-With: XMLHttpRequest
client-timezone: UTC
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Cookie: _sp_srt_ses.1d36=*; _sp_srt_id.1d36=e59638bc-65c8-466e-abff-9543ecc16734.1669477732.1.1669477732.1669477732.6f7bc72c-c245-4fdd-aca4-ace87fdc78df; DV_TRACK=ac1a4cd2-e45f-44c7-ab98-6b34af2a5034; _ga_J9LNZYMXZE=GS1.1.1669477732.1.0.1669477732.0.0.0; _ga=GA1.1.461384038.1669477732
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         104.22.34.208
HTTP/2 200 OK
content-type: application/json; charset=UTF-8
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
vary: Accept-Encoding
access-control-allow-origin: https://20bet.com
access-control-allow-credentials: true
access-control-allow-methods: GET, POST, PUT, PATCH, DELETE, OPTIONS
access-control-allow-headers: DNT,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type,Range,Authorization,client-timezone,LOCATION-SMART-HTML-SESSION-ID,LOCATION-SMART-DEVICE-SESSION-ID
access-control-expose-headers: Content-Length,Content-Range
cf-cache-status: DYNAMIC
server: cloudflare
cf-ray: 7703c5582f5f991b-ARN
content-encoding: br
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  JSON data\012- , ASCII text, with very long lines (10478), with no line terminators
Size:   1044
Md5:    e9954594d2029b16fddcc1ff7ba4b64e
Sha1:   306c1998ae3873a6d6907921eb8f37653eff1633
Sha256: 7bfa535274e00c9fd70dc6399e3b1fc3023ec759780603a71b5c17cc1d16dd06
                                        
                                            GET /ul_cb/sync?dsp_id=409&expires=14&user_group=2&user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&cb=c4689207-ed5e-464f-bd85-b35c1fae75fc HTTP/1.1 
Host: x.bidswitch.net
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Referer: https://20bet.com/
Connection: keep-alive
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         52.29.215.78
HTTP/2 302 Found
                                        
date: Sat, 26 Nov 2022 15:48:53 GMT
content-length: 0
cache-control: no-cache, no-store, must-revalidate
location: //match.sharethrough.com/sync/v1?source_id=bf2b131f1f7eff9d8892972c&source_user_id=&seat_user_id=ab046282-bc70-4948-9aa5-9b6d5fa62ee0&seat_key=409&gdpr=&gdpr_consent=&gdpr_pd=&usprivacy=
X-Firefox-Spdy: h2

                                        
                                            GET /metrika/advert.gif HTTP/1.1 
Host: mc.yandex.ru
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: image/avif,image/webp,*/*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: image
Sec-Fetch-Mode: no-cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache
TE: trailers

search
                                         93.158.134.119
HTTP/2 200 OK
content-type: image/gif
                                        
content-length: 43
date: Sat, 26 Nov 2022 15:48:53 GMT
access-control-allow-origin: *
etag: "637f41b2-2b"
expires: Sat, 26 Nov 2022 16:48:53 GMT
accept-ranges: bytes
last-modified: Thu, 24 Nov 2022 13:04:34 GMT
cache-control: max-age=3600
strict-transport-security: max-age=31536000
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  GIF image data, version 89a, 1 x 1\012- data
Size:   43
Md5:    df3e567d6f16d040326c7a0ea29a4f41
Sha1:   ea7df583983133b62712b5e73bffbcd45cc53736
Sha256: 548f2d6f4d0d820c6c5ffbeffcbd7f0e73193e2932eefe542accc84762deec87
                                        
                                            GET /recaptcha/releases/Km9gKuG06He-isPsP6saG8cn/recaptcha__en.js HTTP/1.1 
Host: www.gstatic.com
                                        
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:105.0) Gecko/20100101 Firefox/105.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Origin: https://20bet.com
Connection: keep-alive
Referer: https://20bet.com/
Sec-Fetch-Dest: script
Sec-Fetch-Mode: cors
Sec-Fetch-Site: cross-site
Pragma: no-cache
Cache-Control: no-cache

search
                                         142.250.74.163
HTTP/2 200 OK
content-type: text/javascript
                                        
accept-ranges: bytes
vary: Accept-Encoding
content-encoding: gzip
access-control-allow-origin: *
content-security-policy-report-only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/recaptcha
cross-origin-resource-policy: cross-origin
cross-origin-opener-policy: same-origin-allow-popups; report-to="recaptcha"
report-to: {"group":"recaptcha","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/recaptcha"}]}
content-length: 162976
x-content-type-options: nosniff
server: sffe
x-xss-protection: 0
date: Fri, 25 Nov 2022 08:12:22 GMT
expires: Sat, 25 Nov 2023 08:12:22 GMT
cache-control: public, max-age=31536000
last-modified: Mon, 14 Nov 2022 03:01:59 GMT
age: 113791
alt-svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000,h3-Q050=":443"; ma=2592000,h3-Q046=":443"; ma=2592000,h3-Q043=":443"; ma=2592000,quic=":443"; ma=2592000; v="46,43"
X-Firefox-Spdy: h2


--- Additional Info ---
Magic:  ASCII text, with very long lines (730)
Size:   162976
Md5:    79d18cf4265108d7cecca1bf4ada6109